Introduce destroy_note_unsafe

[nventuro]

destroy_note currently computes a note hash, which it needs to pass to the kernel so that it can properly squash the note if it was a transient note. This is wasteful, because we typically have already computed the same note hash: e.g. in most cases we read before deleting.

We could have a version of destroy_note that also takes the note hash as a second parameter, where the caller needs to make certain that the hash corresponds to the note. We'd then make e.g. get_notes return both the notes and the hashes, so that they can be passed to destroy_note_unsafe.

[nventuro]

With #7834 merged, we should use this new function in pop_notes.