Security token transfer restrictions explained: how whitelists, ERC-3643 identity checks, freezes and forced transfers decide who can hold a token.