Cardano Updates

  withCRSLookup only checked txOutReferenceScript (script hash) but not
  txOutAddress. An attacker could create a UTxO at any address, attach the
  legitimate CRS script as a reference, and provide malicious G2 identity
  elements as datum — bypassing the KZG membership check and fanning out
  arbitrary outputs after the contestation deadline.

  Fix: add addressCredential (txOutAddress resolved) == ScriptCredential
  expectedHash check. Since expectedHash is already compiled into the head
  validator, no new parameters are needed. Move CRS UTxO publishing to the
  CRS script address (which already always-fails) so the on-chain check is
  self-consistent. Update the test generator to match.

  Add WrongAddressCRS mutation tests to FinalPartialFanout, PartialFanout,
  and FanOut (the full fanout path had no CRS mutation coverage at all).

Signed-off-by: Sasha Bogicevic <[email protected]>

Removed `onException`, since the socket is already closed using
a bracket.

In `CloseOnRead` case ignore `Shutdown {}` - as in other cases.  This
should fix:

```
     mux close (IO):                                   FAIL (0.08s)
      *** Failed! Falsified (after 8 tests):
      CloseOnRead
      []
      <function>
      -10
      Right (Shutdown (Just (IOException withIODataPtr (recvBuf): invalid argument (An existing connection was forcibly closed by the remote host.) "recv errored")) (Failed (IOException withIODataPtr (recvBuf): invalid argument (An existing connection was forcibly closed by the remote host.) "recv errored")))
```

The tests started to fail due to usage of version data codec which
doesn't satisfy round robin property on invalid version data in the
previous commit.

Round handshake and chain sync rtt to milliseconds (as we do for keep
alive rtts).

Exposed `nodeTo{Node,Client}VersionDataCodec` instead.

Changed the format to log one JSON encoded message per line.  When we
logged a list of messages as JSON output, they get interleaved with
other messages, making the output not a valid JSON unless quiet mode was
used.

We used to need to call `cborTermVersionDataCodec` to get
`VersionDataCodec` from `CodecCBORTerm`.

The `VersionDataCodec` and `cborTermVersionDataCodec` is moved to
`ouroboros-network:api` library (`Ouroboros.network.CodecCBORTerm`
module).

`cardano-diffusion` provides both `nodeToNodeVersionDataCodec` and
`nodeToClientVersionDataCodec`.

This required a refactorisation in tests to get rid of some newtype
wrappers, however the semantics of all the tests is preserved.

Extracting `SecretKey` construction outside, makes resource allocation
in `bracket` much cheaper, which is absolutely what we want for proper async
exception handling

We also need to make sure that tag is fully set to zero, since it
doesn't llook like the full overwrite is guaranteed.