node: sign bridge vote-extensions via checkpoint/attestation RPCs

[diorwave]

• Validator no longer signs bridge vote-extensions with blind SignRaw.
• With a remote signer: valset checkpoint → SignBridgeCheckpoint, oracle attestations →
  SignOracleAttestation; node asserts the returned 64-byte sig equals the expected value.
• Fail-safe: bad node data → signer rejects → missed signing (recoverable jail), never a wrong sig.
• Local file-keyring path unchanged.

[krasi-georgiev]

The reason for this pr is to protect the signer from unauthorised tx. With blind sign someone with access to the layer server can steal the funds.

[diorwave]

right, node now signs via checkpoint/attestation rpcs, so blind SignRaw can be dropped and a compromised layer server cant steal funds.

[akremstudy]

Hey @krasi-georgiev, I'd like to combine #1013 and #1034 into one PR. Your validated signing approach is the right one now that the sidecar disables blind signing; I just want to fold in a bit of #1013's structure on top since its small signer interface is cleaner than implementing the whole keyring. Could I do that on your branch so it stays your PR?
cc: @diorwave

[diorwave]

• TestVoteExtensionTestSuite in app/ is passing now. The new SignSnapshot and CheckAndSignValidatorCheckpoint paths mock GetKeyring, so failures no longer cascade from the parent test.
• gofumpt/gci formatting has been fixed across all changed files.
  build-primary (Heighliner) fails on all fork PRs because it tries to clone the branch ref from the base repo, so the failure isn't related to this code.

On the maintainer side, the latest commit's checks are in action_required and need workflow approval. The label check also requires either the stateChange or noStateChange label.

Regarding @akremstudy's suggestion to combine this with #1013, I'm happy either way. I can rebase this onto #1013 or keep the PRs separate, whichever you prefer.