Rollup node: require --apply-unsafe-patches flag to apply patches

What

This MR adds the flag --apply-unsafe-patches to the rollup node CLI and the application of any unsafe patch requires that the rollup node be started with this flag.

Follow up on !12907 (merged) and !12957 (merged).

Why

This forces users to be aware that they are operating on a rollup that is being patched by the rollup node.

Manually testing the MR

dune exec tezt/tests/main.exe -- -f sc_rollup.ml unsafe_patch