[Hardening] Assure batch_update_compass cannot be sent other than by vote

[byte-bandit]

Since the batch_update_compass message is treated like very other message going to compass, the current architecture in Paloma would allow a hostile network takeover by an attacker modifying the Paloma code base to inject an EVM message with the batch_update_compass action.

I can think of two ways to avoid this:

• check for valid outstanding deployment when this message is entered on a queue
• check during the BytesToSign building

The latter would more secure (maybe), but there is no infrastructure there at all.

Looking into the first.