fix(sync): validate discovery hash responses

[evan-forbes]

Motivation

Closes: N/A

This fixes a DoS variant of GHSA-h9hm-m2xj-4rq9 where malformed nonempty FindBlocks responses could poison sync state. For example, a response shaped like [unknown, known, random] could cause Zebra to enqueue known hashes and then cancel future downloads when the known block download failed.

Solution

• Validate legacy discovery hash responses before mutating download state.
• Reject duplicate hashes, known hashes after the first unknown hash, locator echoes in advertised suffixes, and nonproductive shapes such as [R].
• Apply the validation in both tip discovery and extension-building paths.
• Add regression coverage for [U,K,R], duplicates, [R], and malformed extension responses.

Validation

• cargo test -p zebrad components::sync
• cargo fmt --all -- --check

In this environment the zebrad tests were run with CXXFLAGS='-include cstdint' to work around a local librocksdb-sys C++ include issue.

AI Disclosure

Used OpenAI Codex to audit, implement, and test this change.

[ValarDragon]

LGTM, lets merge in after Friday