LogicSig args are not signed so any relay can append args to a
transaction in flight. The program cannot detect it: it can prove that
at least N args exist, never that at most N do.

That is harmless while args are free. Once they are priced, and
combined with a refundable fee, padding would start consuming the
sender's extra fees.

Under the new RequireLogicSigArgAccess consensus parameter, a LogicSig may
carry no argument it did not read: none above the highest index it read,
and none below that index unless the argument is empty. Empty holes remain
legal, so goal tealsign's padding keeps working.

opArgN records reads in a bitmask on EvalContext, and logicSigVerify
checks it -- this is a rule about a transaction, not about what a program
means, so it sits beside the other transaction-level LogicSig rules.