Ensure TokenWithRefunds::complete_refund(...) is unlikely to revert

[benesjan]

If the public teardown of a TokenWithRefunds reverted this would result in a loss of notes for both the fee payer and the user. For this reason it should be attempted to make the complete_refund function very unlikely to revert.

Note that if this is not done the FPC might be attacked! --> An attacker could be submitting reverting txs while the FPC would be spending his fee juice and not getting the accepted asset.

[benesjan]

This is the line with the problematic revert.

The goal of this issue is to move that check to the private part of the function.

How we could tackle this by enforcing during setup that the fee payer has enough funds to cover a "maximally complex tx"
--> do we have something like max gas limit to compute the gas fee of such a tx?
--> would this be acceptable or is it considered too expensive?

[benesjan]

Replaced by #10805.