Add hashAuthDataRoot to Block network messages, and semantically verify it

[teor2345]

Motivation

In #2134, Zebra validates the hashAuthDataRoot in the finalized state. But this is very late in the validation pipeline.

We'd prefer to validate it as the first step in block and checkpoint verification. That way, the transaction authorizing data is bound to the block header before we do any other verification. That improves the security of Zebra's verification pipeline.

Specifications

Transaction Identifier Non-Malleability: https://zips.z.cash/zip-0244

Designs

Zebra's parallel verification pipeline: https://github.com/ZcashFoundation/zebra/blob/main/book/src/dev/rfcs/0002-parallel-verification.md#definitions

Solution

• Write a ZIP that adds the commitments used to generate hashBlockCommitments to the end of Block messages in the network protocol
• Add these commitments to Zebra's block::Header, parsing them on the way in, and sending them on the way out
• Validate the hashAuthDataRoot as the first step in block and checkpoint verification

Alternatives

This change improves security, but it's not required for full validation. We'll probably do it during the network protocol upgrades after NU5.

Related Work

#1874 and other ZIP-244 work.

[daira]

I assigned ZIP number 240 260 for this. (The title is just a placeholder.)

[teor2345]

This protocol change would be useful, but other things are higher priority.