Cardano Updates

A separate $data output makes the executable (and signed dylibs) embed a
reference to the sibling $data output via Paths_*. When $data already exists
in the store, Nix builds $out against a scratch $data path and rewrites the
scratch hash to the final hash inside the already-signed Mach-O after the
builder exits (registerOutputs/rewriteStrings, "cross fingers"), without
re-signing. On aarch64-darwin, where ad-hoc signatures are mandatory, the
resulting stale signature is invalid and macOS SIGKILLs the binary at launch.

Defaulting enableSeparateDataOutput to false on darwin makes Paths_* a
self-reference ($out/share), which Nix does not rewrite in normal builds, so
the signature stays valid. Override per-component to re-enable.

refactor: enhanced support for unknown signed entity

by extracting the shared logic in helpers

so it can be reused in Alonzo

in `mkStAnnTx`

for more per-era control over revalidation of transactions

to replace `applyTxValidation`, operating on `ValidatedTx`.
Define `applyTxValidation` in terms of `applyTxWithValidation`