Revisit multisig exports

[Stebalien]

The currently exported methods on multisig effectively defeat the method-number restrictions as any on-chain actor can use a multisig as a proxy to send any message.

Options:

1. Do nothing. This would allow even "private" methods to be invoked on-chain using the multisig as a proxy.
2. Remove the exported methods from the multisig.
3. Check the method number on propose and, if it's in the "reserved" range, make sure that the caller is a builtin actor (e.g., an account).

[arajasek]

Thanks for flagging this, you're right about the effect here. I'm in favour of 2 -- we really don't want people relying on the builtin multisig actor much more than necessary anyway, let's just not export these methods.

[anorth]

Great catch. I agree with (2), which will put this in the same bucket at payment channel – not exported on the path to deprecation.

[jennijuju]

Closed by #967