Test adversarial quorum payloads and voters

Quorum authorization should bind signatures and votes to the intended payload and direction. This change adds adversarial quorum tests to the existing root Go suite:

• common/quorum_payload_security_test.go: a payload-binding matrix for observed txs, network fees, solvency, errata, and price feeds. Each row changes one security-relevant field (direction, chain, tx id, addresses, coins, gas, memo, heights, vault, rate/size, version, time, amount, decimals). It then checks that the original signature no longer verifies.
• x/thorchain/handler_quorum_security_test.go: handler-level tests driven by real secp256k1 attestations from a four-node active set. The expected signers come from the fixture, not from the voter or handler.
  • Network fee, errata and solvency: each has a matrix covering threshold minus one, threshold, threshold plus one, reordered and duplicate signers, and a departed signer. Each also has a tamper row: a changed signed rate for network fee, a cross-chain replay for errata, and a solvent report presented as insolvent for solvency. Solvency uses its minority consensus of two of four.
  • Signed price feeds: the rate, timestamp and required-symbol version are tampered while the original signature is kept. An unchanged control row proves the feed would otherwise be saved, so the "no price saved" assertion means something.
  • Observed tx direction flip: honest inbound attestations for a vault self-send with a swap memo are resubmitted with Inbound=false. The test asserts they don't count as an outbound, so the vault isn't debited and no members are slashed. An outbound-attested control row proves that path can be reached.

Validation: Focused and mocknet suites passed locally; the integrated root unit job passed. This topic is also included in draft !5181 (closed). This MR will run its own CI against develop; review and merge coordination should avoid landing the same change twice.