Transaction builder should handle invalid tip height

[notmandatory]

"In the transaction builder, current_height will crash on an invalid absolute locktime height. If None was provided by the caller, this would let a remote chain source crash us by providing at invalid tip height. But that's considered out of scope. Although it seems unlikely that this parameter would be exposed to a third party, it's safer to only panic on inconsistent internal state and not on externally provided inputs."

"Out of scope since we trust our chain source but the transaction creation code will crash if the tip's height is not less than 500'000'000 (LockTime::from_height L1305), which could allow a remote Electrum or Esplora server to crash us."