Dark SDK 0.4.3: Robustness and hardening

Robustness and hardening. Upgrading is recommended; no API changes.

Changes

• One incoming transfer that will not open no longer blocks the wallet. A transfer whose hint cannot be opened (malformed, or above the bound for its block) used to make getBalances, applyPending, history and Dark Exit throw. The pending total is now recovered by a bounded search over the whole pending ciphertext, and that one transfer shows no amount in the history.
• The solved witness and the prover input, which contain the account's secret, live only in an owner-only temporary directory (0700, files 0600) for the whole time they exist.
• The AEAD nonces of hint, senderHint and aeBalance are hedged like the encryption randomness: derived from the key, the context and fresh randomness, so a broken random number generator cannot repeat a nonce. The wire format is unchanged.
• balancePublic also takes the pending ciphertext into account.
• A verifier revert caused by a proof built on state that has since moved is reported as stale state (sync and retry); a bad proof or a vault/verifier mismatch is reported as a failure.
• The keyCheckRpcUrl documentation states which RPC source sees each recipient-key lookup.