serviceability: add ip_verifier_authority_pk to GlobalState and rotate it via SetAuthority

[elitegreg]

Part of RFC-27 (tracker: #4194).

The verifier public key is the trust root for proof validation. RFC-27 puts it in onchain global state so it rotates without a program upgrade.

What

• Append pub ip_verifier_authority_pk: Pubkey to GlobalState (state/globalstate.rs), after feed_authority_pk. Append only — existing accounts deserialize with Pubkey::default() through the unwrap_or_default() path, same as feed_authority_pk did.
• Add it to Default, Display, and the TryFrom<&[u8]> chain.
• Add ip_verifier_authority_pk: Option<Pubkey> to SetAuthorityArgs (processors/globalstate/setauthority.rs) and its Debug. BorshDeserializeIncremental keeps old-arg transactions decoding.
• Surface it in the CLI: smartcontract/cli/src/init.rs and the global-config/authority set + get paths so operators can read and rotate it.
• Rust SDK (smartcontract/sdk/rs) GlobalState mirror and any SetAuthority command builder.

Behavior when unset

Pubkey::default() means "no verifier configured". Enforcement (the onchain validation issue) must treat that as a hard reject when the feature flag is on, never as "any signature passes". Add a test for exactly that.

Acceptance

• test_state_compatibility_globalstate still passes against the existing base64 vectors, plus a new vector that includes the field.
• Serialization test updated.
• SetAuthority test rotating the key and leaving the other authorities untouched, and one confirming a None leaves it unchanged.
• Authorization unchanged: GLOBALSTATE_ADMIN permission or the legacy foundation path.
• SDK deserializer work for Go/TS/Python is tracked separately.