Instead of ignoring all exec events that happen in a hat/child profile, only disallow child exec. ix and px are valid options inside a hat and are now offered to the user.
(When the tools support nested child profiles one day, we can even allow child exec again.)
For 3.0, this also needed backporting another commit:
Fix crash caused by ask_exec()
ask_exec still uses aa[profile][hat], therefore
This fixes a regression from converting lots of code to use flat profile//hat array keys.
(cherry picked from commit 755b5d11)