Prevent submitting calls to messages marked as immutable

[xermicus]

Summary

Related issue: use-ink/ink#1969

ink! can't properly prevent messages supposed to be immutable from changing state regardless. Instead, we rely on the client and tooling to honor the mutates field in the metadata.

Description

Without this change, cargo contract will happily execute messages like the one below. This message receives &self which signals it should be immutable. Other contract languages, e.g. Solidity, would refuse to compile this. Instead, we rely on the client to prevent it. The rogue balance transfer is just an illustration; Things like that might come from a rogue snippet or sit inside a rogue library.

        #[ink(message)]
        pub fn get(&self) -> bool {
            // oops
            self.env()
                .transfer(self.env().caller(), self.env().balance())
                .unwrap();

            self.value
        }

Checklist before requesting a review

• My code follows the style guidelines of this project
• I have added an entry to CHANGELOG.md
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
• Any dependent changes have been merged and published in downstream modules