smite-ir: add malformation parameter to funding_created

[NishantBansal2003]

ref: #178

Depends-on: #212

Add a malformation parameter to SendFundingCreated that overwrites an allowlisted field of funding_created before sending it to the target. Some fields currently only contain valid values, so this allows the IR to exercise their invalid values as well.

Oracle state is updated based on the message actually sent to the target, after applying the malformation. If the malformed signature cannot be decoded, we send only the invalid signature without marking the state as desynced, since the target should simply reject it as an invalid signature rather than behave differently.

The generator produces only non-malformed funding_created messages, OperationParamMutator adds malformations using repeated bytes, random bytes, or interesting integers matching the field's exact width.

I verified it, and smite is now able to detect the bug disclosed in CLN funding_txid==0 assertion crash

[erickcestari]

AFIK we haven't mentioned the IR in bolts crate until this PR. I think it would be better if bolts had no IR knowledge.

Suggested change

	/// A message field whose encoded bytes can be overwritten before the message
	/// is sent.
	///
	/// These identify fields for which the IR can only construct valid values, so
	/// invalid values can only be put on the wire by overwriting their encoded
	/// bytes. All other fields are reachable through the IR's parameters.
	///
	/// Offsets include the 2-byte message type prefix and therefore index directly
	/// into the encoded message.
	#[derive(Debug, Clone, Copy, PartialEq, Eq)]
	pub struct MalformableField {
	/// Field name to overwrite.
	pub name: &'static str,
	/// Byte offset in the encoded message, including the message type prefix.
	pub offset: u16,
	/// Field length in bytes.
	pub len: u16,
	}
	/// Location of a fixed-offset field within an encoded message.
	#[derive(Debug, Clone, Copy, PartialEq, Eq)]
	pub struct FieldSpan {
	/// Field name as written in the BOLT spec.
	pub name: &'static str,
	/// Byte offset in the encoded message, including the message type prefix.
	pub offset: u16,
	/// Field length in bytes.
	pub len: u16,
	}

[erickcestari]

This should live inside the malform.rs, since the fields that are unreachable depends on the IR's operation, not on the codecs.

Suggested change

	pub const MALFORMABLE_FIELDS: &'static [MalformableField] = &[
	Self::FUNDING_TXID_FIELD,
	Self::FUNDING_OUTPUT_INDEX_FIELD,
	Self::SIGNATURE_FIELD,
	];

[erickcestari]

These two returns aren't being covered in the tests if they're also applying correctly the malformation.

// Without both the recorded `open_channel` and the peer's `accept_channel`
    // we cannot build the commitment to sign, so fall back to an unsigned
    // `funding_created` and leave `channel_states` untouched.
    let Some(pending) = negotiations.get(&temporary_channel_id) else {
        return Ok(encoded);
    };
    let open_channel = &pending.open_channel;
    let Some(accept_channel) = pending.accept_channel.as_ref() else {
        return Ok(encoded);
    };