Enforce saner checks on wizard SVs and MAGIC tokens

This commit adds a variety of helper functions that extract the vmg_wizard
object from a SV or a MAGIC token. Version with (for direct interaction
with the user) and without checks (for magic callbacks, where we know the
MAGIC token is already valid) are provided.