Implement PrivateSet.pop_notes

[nventuro]

Once #4940 is merged we should perform this rename. There's multiple use cases in which we only care about removal and not retrieval, so we get things like:

let notes = set.get_notes(opts);
assert(notes[0].is_some());

which are how we'd make sure we deleted at least one note, though the intent is highly cryptic. #4988 will also help in removing the assert statement, so let _ = set.pop_notes(opts) will mean that at least some notes were deleted.

[nventuro]

With #4940 closed as wont-merge, this is no longer 'just' a rename. We may wish to implement pop_notes and/or pop_note for PrivateSet, but then it'd be separate functionality from get_notes. Perhaps the existence of both functions would help the reader understand that get_notes does not nullify them, and why nullifying is important.

[nventuro]

Once we have #7831, we can add pop_notes to take care of the read + destroy unsafe cycle, also skipping the check inside remove that prevents removal of unread notes (since we can guarantee that we have read it, and we save more hashing and checks that way).