Document or change behavior of #[account(signer)] when CPI feature is enabled

[armaniferrante]

When the "cpi" feature is enabled we don't check the signer field. See https://github.com/project-serum/anchor/blob/master/lang/syn/src/codegen/accounts.rs#L347.

We should either document or change this behavior. One should never enable the CPI feature when building and deploying the program. It should only be used when using a program as a CPI dependency.

[armaniferrante]

A better solution is to add a new attribute #[account(program_signer)], or #[account(signer = program)] that has the behavior described above. The #[account(signer)] attribute should always check the signature, even if the cpi feature is enabled.

[rav3nh0lm]

actually, how does it work now? https://github.com/project-serum/anchor/blob/master/CHANGELOG.md#features-3 is the Signer that is introduced here how we are supposed to check this now?

[armaniferrante]

This is no longer necessary now that #824 was implemented, and one shouldn't run into this as a result.

We can remove the special case for the cpi feature.