Cardano Updates

Subsume delegations into active-stake

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

  When DecommitFinalized or CommitFinalized arrives while a snapshot is
  in-flight, bumping the version immediately causes the leader's ReqSn
  (sent with the old version) to be rejected by followers who already
  observed the chain event, permanently stalling the head.

  Fix: store the new version as pendingDepositVersion / pendingDecommitVersion
  and collect chain-state acknowledgements via AckSn. The version is applied
  only once all parties have seen the on-chain event, keeping the version
  stable for the duration of the snapshot signing round.

  Also fix skipPostedDecommit to compare utxoFromTx instead of
  resolveInputsUTxO, which caused the same decommit to be included in
  successive snapshot requests when DecommitFinalized had not yet arrived.

Signed-off-by: Sasha Bogicevic <[email protected]>

Type-erase at the consumer boundary by introducing JsonEventConsumer
in notificationsApi. WebhookPublisher now works with Seq[JsonEventConsumer]
instead of typed consumers. JsonEventEncoders moved to apiServer where
WebhookPublisherFactory wires typed consumers with domain-specific encoders.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

The Security Council has approved a new SECURITY.md aligned with the bug-bounty process. Please update your project’s SECURITY.md with the correct links for your project and confirm that private vulnerability reporting is enabled for your repository.
All bug bounty details found here:
https://opensourcecommittee.docs.intersectmbo.org/about/paid-open-source-model-posm/bug-bounty-program'

- apiServerJobsCore: replace ES256KSigner/EdSigner with VcJwtService
- credentialsPreX: add JwtDecoder param to decouple from JwtCredential/JwtPresentation
- oid4vciCore: move JwtSignerImplicits to sharedCrypto
- oid4vciHttp: add explicit credentialsVcJWT dep (was transitive via oid4vciCore)
- Add arch constraints for apiServerJobsCore and oid4vciCore

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Update the activestake field to hold the delegation along with the stake.
  For this, we introduce the StakeWithDelegation type using NonZero Compact
  Coin for stake along with the pool Id.

* In tests, mkActiveStake combines a stake-only and a delegation-only maps.

* Remove fvDelegs from FreeVars.
* Also make epochStateStakeDistrL return ActiveStake.
* Update the golden test.

* resolveConwayInstantStake to return ActiveStake.

Co-authored-by: Aniket Deshpande <[email protected]>