token-2022/cpi-guard: add a Pinocchio version #786

tokens/token-2022/cpi-guard ships only an Anchor version. This proposes a Pinocchio version, matching the other Token-2022 extension examples that already have one.

CpiGuard can't be toggled through a CPI, so the program exposes one TransferChecked CPI and the test shows the guard's effect: the CPI transfer is rejected while the guard is enabled on the source account, and goes through (balance moves) once it is disabled.

Implementation is ready in #701.