The associated token program instructions default to the legacy SPL
token program. We pass the token_program as an argument to support
token2022 tokens too.

TODO: the old token program still works -- is this secure? I think so
but double check

to be able to test if it was executed

wip because with this the test tx size is 5 bytes larger (for transfer)
than the limit. The way to mitigate is to introduce lookup tables.
That mitigation will exist in the tests, but will also have to be done
on real deployments (since the transfer hooks might add an arbitrary
number of extra acconuts, so we should leave as much headroom as possible)