Resolve race condition regarding when forwarded output is set

The higher-level scanner code in multisigs/mod.rs now creates a series of plans
with limited context. These include forwarding and refunding plans, moving all
handling of forwarding flags on the scanner's clock and therefore safe.

Also simplifies the refunding a decent bit.

processor/src/signer.rs

@@ -404,6 +404,7 @@ impl<N: Network, D: Db> Signer<N, D> {
     // branch again for something we've already attempted
     //
     // Only run if this hasn't already been attempted
+    // TODO: This isn't complete as this txn may not be committed with the expected timing
     if SignerDb::<N, D>::has_attempt(txn, &id) {
       warn!(
         "already attempted {} #{}. this is an error if we didn't reboot",