Cardano Updates

cardano-db-sync's off-chain pool and vote metadata fetchers reject
URLs whose host or resolved IP is in a private, loopback, or
link-local range as an SSRF mitigation (see parseOffChainUrl and
newRestrictedManager in cardano-db-sync/src/Cardano/DbSync/
OffChain/Http.hs). Local-cluster test setups whose metadata is
served from http://localhost:.../poolN.json or similar therefore
cannot exercise the success path of the fetcher.

This adds an opt-in CLI flag that replaces both layers of the
restriction with a no-op for the duration of the run, intended
for local-cluster testing only. Off by default; the existing
restriction continues to apply to every production deployment.

* New SyncNodeParams field enpAllowPrivateOffChainUrls plumbed
  through SyncOptions (soptAllowPrivateOffChainUrls) into the
  off-chain fetcher threads.
* parseOffChainUrl now takes a Bool: when True the isLocalhostHost
  rejection is skipped.
* newRestrictedManager now takes a Bool: when True it installs a
  permissiveRestriction (addressRestriction returning Nothing for
  every address) instead of offchainRestriction, so DNS-resolved
  private IPs are no longer blocked at connect time either.
* New Hedgehog suite Cardano.DbSync.OffChain.HttpTest covering
  both modes for localhost/127./[::1]/10./192.168. plus a public
  URL and non-HTTP schemes.

Signed-off-by: Chris Guiney <[email protected]>

Signed-off-by: akrepala <[email protected]>

Move six closed-form cert-deposit helpers from
src/Ledger/Dijkstra/Specification/Utxo.lagda.md to
src/Ledger/Dijkstra/Specification/Certs.lagda.md:

  + updateCertDeposit
  + updateCertDepositsStep  (new named extraction of the fold body)
  + updateCertDeposits
  + coinFromDeposits
  + depositsChange
  + newCertDeposits
  + refundCertDeposits

These helpers depend only on Certs-level definitions, so their natural
home is Certs.lagda.md.  Their placement in Utxo.lagda.md forced any
proof referencing them to take the larger TransactionStructure /
AbstractFunctions parameter set, blocking proofs in
Certs.Properties.PoV(Lemmas) (parameterised only by GovStructure) from
referring to them.

govProposalsDeposits stays in Utxo.lagda.md — it depends on GovProposal
from Gov.Actions, not on a Certs-level type.

Bundled bug fixes to updateCertDeposits:

  + Typo: DState.deposits was being set from the GState delta instead
    of the DState delta.

  + Fold direction: was foldr (right-to-left).  CERTS processes certs
    left-to-right via BS-ind's head-first decomposition.  Changed to
    foldl, matching Conway's left-to-right recursion and Dijkstra's
    own applyToRewards.  Counterexample under foldr:
    [delegate c d, dereg c (just d)] on a fresh credential should
    leave c ∉ deposits per CERTS, but foldr processes dereg first
    (a no-op) then delegate, ending with c ∈ deposits.

updateCertDepositsStep is the inner fold body extracted as a named
function so downstream proofs in Certs.Properties.PoV can state and
use a per-step pots equation about it.

Also: add HasCoin-UTxOState (Utxo.lagda.md) and HasCoin-LedgerState
(Ledger.lagda.md).  HasCoin-LedgerState sums UTxO state total, DState
rewards balance, and the three deposit pots via the hoisted
coinFromDeposits — the form needed to balance against the UTXO
batch-balance equation.

Closes #1208.

Signed-off-by: akrepala <[email protected]>

Signed-off-by: Chris Gianelloni <[email protected]>

* build(deps): bump esbuild and vite in /examples/dingo-sundae-preview

Removes [esbuild](https://github.com/evanw/esbuild). It's no longer used after updating ancestor dependency [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). These dependencies need to be updated together.


Removes `esbuild`

Updates `vite` from 5.4.21 to 8.0.14
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.14/packages/vite)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version:
  dependency-type: indirect
- dependency-name: vite
  dependency-version: 8.0.14
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Chris Gianelloni <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Gianelloni <[email protected]>

Co-authored-by: sg-doc-holiday[bot] <219201796+sg-doc-holiday[bot]@users.noreply.github.com>