transaction: disallow negative outputs

Otherwise it is possible to make outputs which will sum
to the expected value, but steal GAS from some other account.

pkg/core/transaction/transaction.go

@@ -100,6 +100,12 @@ func (t *Transaction) DecodeBinary(br *io.BinReader) {
 	br.ReadArray(&t.Attributes)
 	br.ReadArray(&t.Inputs)
 	br.ReadArray(&t.Outputs)
+	for i := range t.Outputs {
+		if t.Outputs[i].Amount.LessThan(0) {
+			br.Err = errors.New("negative output")
+			return
+		}
+	}
 	br.ReadArray(&t.Scripts)
 
 	// Create the hash of the transaction at decode, so we dont need