EVM/Kernel: ensure FA deposit cannot invoke XTZ/FA withdrawal precompiles

What

FA deposits are disallowed to invoke XTZ/FA withdrawal precompiles (split from !14390 (merged)).

Why

Although circular calls do not immediately introduce issues, there can be some implications we've not discovered yet.

Potential problems:

• Amplified spam attack
• Outbox censorship attack
• Double spending attack (tez/tickets)

How

This PR splits precompile set in pure/impure subsets, where the latter consists of XTZ/FA withdrawal precompiles.
It also makes sure FA deposits cannot invoke any of the impure precompiles at the kernel level.

Manually testing the MR

make test

Checklist

• Document the interface of any function added or modified (see the coding guidelines)
• Document any change to the user interface, including configuration parameters (see node configuration)
• Provide automatic testing (see the testing guide).
• For new features and bug fixes, add an item in the appropriate changelog (docs/protocols/alpha.rst for the protocol and the environment, CHANGES.rst at the root of the repository for everything else).
• Select suitable reviewers using the Reviewers field below.
• Select as Assignee the next person who should take action on that MR