bump cosmos/iavl to v1.2.8

Bump cosmos/iavl to v1.2.8

What

Raise the pinned github.com/cosmos/iavl from v1.2.4 to v1.2.8 in go.mod and test/simulation/go.mod, with matching go.sum entries. IAVL is an indirect dependency via cosmossdk.io/store; a main-module requirement is enough to select the newer version.

Why

IAVL v1.2.4 updates its fast-node cache before the commit batch is written to disk. A query that misses the cache in that window reloads the pre-commit value and re-inserts it, leaving a stale entry that the next block's execution reads as live state. Nodes serving RPC traffic diverge with wrong Block.Header.AppHash or wrong Block.Header.LastResultsHash at random heights; validators, which serve little query load, are unaffected.

Upstream fix: cosmos/iavl#1142 ("fix(nodedb): fix race between updating fast node cache and db commit"), backported to the v1.2 line as cosmos/iavl#1144 and released in v1.2.8. v1.2.7 is retracted upstream and should not be used.

Risk

Patch-level bump. v1.2.8 has the same dependency set as v1.2.4 and no database format change, so it runs on existing data directories. Operators who cannot upgrade immediately can set iavl-disable-fastnode = true in app.toml as an interim mitigation.