Add config option to deny `rr::trust_me` and `rr::only_spec`

We should have a flag that checks that all annotated proofs are actually done and we don't assume any specifications.