Only cache xpubs that have a hardened last step

Summary:
Also adds tests for this:
For ranged descriptors with unhardened derivation, we expect to
find parent keys in the cache but no child keys.

For descriptors containing an xpub but do not have unhardened derivation
(i.e. hardened derivation or single xpub with or without derivation),
we expect to find all of the keys in the cache, and the same
number of keys in the cache as in the SigningProvider.

For everything else (no xpub), nothing should be cached at all.

Backport of Core PR18204 part [6/7] : https://github.com/bitcoin/bitcoin/pull/18204/commits/deb791c7ba057a3765d09b12bf3e55547a5298e4

Depends on D8386

Test Plan:

ninja all check

Reviewers: #bitcoin_abc, majcosta

Reviewed By: #bitcoin_abc, majcosta

Differential Revision: https://reviews.bitcoinabc.org/D8387