Disable eth_sign by default

[holantonela]

Background

After looking at various phishing kits (and de-obfuscating), there are enormous trends between different kits that they all abuse eth_sign to ask users to inadvertently sign a transaction (as MetaMask UI is opaque to an on-chain transaction being signed). You can read more about the attack here.

@409H'd estimate that the abuse of eth_sign is near equal to the abuse of Wyvern and Seaport contracts in a manner to steal NFTs through creating orders for 0 eth to a specific beneficiary.

In short: eth_sign has been consistently abused by phishers/scammers to steal funds and the case may be that only power-users who use very legacy dapps may need to still use eth_sign.

• Disable eth_sign by default - throw an ethErrors.rpc.methodNotFound exception
• Allow the user to enable eth_sign through "Advanced Settings"

RPC Method preferences are stored within rpcMethodPreferences in the store state, allow for us to develop this further if someone wants to lock down rpc calls into MetaMask.