feat: enforce the circuit verification key registry

[jpraynaud]

Content

This PR includes the enforcement and integration of the circuit verification key registry introduced in #3513:

• Enforce the certification of the circuit verification keys in MithrilCertificateVerifier for the Snark and IvcSnark aggregate signature types, on both the standard and the full chain shortcut paths
• Resolve the registry of the client's network in mithril-client through the published networks.json (aggregator endpoint match, genesis verification key fallback), enabled by default with bounded, retried and size-capped downloads
• Enforce the registry in the aggregator at certificate creation and chain synchronization, reading the file at circuit_verification_key_registry_path (defaults to the data stores directory)
• Add the genesis sign-circuit-key-registry (air-gapped signing with authoring validation) and test-only genesis bootstrap-circuit-key-registry subcommands to the aggregator
• Generate and enforce the registry on the fly in the end to end tests at genesis bootstrap
• Add the revocation runbook and cross-reference it from the circuit keys update runbook

Pre-submit checklist

• Branch
  • Tests are provided (if possible)
  • Crates versions are updated (if relevant)
  • CHANGELOG file is updated (if relevant)
  • Commit sequence broadly makes sense
  • Key commits have useful messages
• PR
  • All check jobs of the CI have succeeded
  • Self-reviewed the diff
  • Useful pull request description
  • Reviewer requested

Issue(s)

Relates to #3148

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

Test Results

     5 files  ± 0     221 suites  ±0   1h 0m 32s ⏱️ - 41m 46s
 3 592 tests  - 45   3 592 ✅  - 45  0 💤 ±0  0 ❌ ±0 
11 714 runs   - 54  11 714 ✅  - 54  0 💤 ±0  0 ❌ ±0 

Results for commit 222ca3e. ± Comparison against base commit cccb650.

This pull request removes 58 and adds 13 tests. Note that renamed tests count towards both.

mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_out_of_bounds
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_too_large_for_circuit_range
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::indices_not_increasing
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_merkle_path_mismatch
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_swap_keep_merkle_path
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_wrong_verification_key
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_corrupt_sibling
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_flip_position
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_long
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_short
…

mithril-aggregator ‑ tools::circuit_key_registry::tests::add_entry::appends_the_entry_and_increments_the_version_of_an_existing_registry
mithril-aggregator ‑ tools::circuit_key_registry::tests::add_entry::creates_a_signed_registry_at_the_minimum_version_when_the_file_is_missing
mithril-aggregator ‑ tools::circuit_key_registry::tests::add_entry::fails_on_an_entry_with_an_inverted_epoch_range
mithril-aggregator ‑ tools::circuit_key_registry::tests::add_entry::fails_on_an_existing_registry_signed_by_another_genesis_key
mithril-aggregator ‑ tools::circuit_key_registry::tests::bootstrap::bootstraps_a_verifiable_registry_whitelisting_the_production_circuit_keys_without_protocol_parameters
mithril-aggregator ‑ tools::circuit_key_registry::tests::export_digests::exports_the_production_digests_without_protocol_parameters
mithril-aggregator ‑ tools::circuit_key_registry::tests::sign::fails_on_a_registry_version_below_the_minimum
mithril-aggregator ‑ tools::circuit_key_registry::tests::sign::fails_on_a_registry_with_an_inverted_epoch_range
mithril-aggregator ‑ tools::circuit_key_registry::tests::sign::fails_on_an_invalid_registry_file
mithril-aggregator ‑ tools::circuit_key_registry::tests::sign::signs_a_registry_and_writes_a_verifiable_signed_registry
…

♻️ This comment has been updated with latest results.