Authenticate blinded path contexts with a secret AAD in the MAC

[TheBlueMatt]

When we receive an onion message, we often want to make sure it was
sent through a blinded path we constructed. This protects us from
various deanonymization attacks where someone can send a message to
every node on the network until they find us, effectively
unwrapping the blinded path and identifying its recipient.

We generally do so by adding authentication tags to our
`MessageContext` variants. Because the contexts themselves are
encrypted (and MAC'd) to us, we only have to ensure that they
cannot be forged, which is trivially accomplished with a simple
nonce and a MAC covering it.

This logic has ended up being repeated in nearly all of our onion
message handlers, and has gotten quite repetitive.

Instead, here, we simply authenticate the blinded path contexts
using the MAC that's already there, but tweaking it with an
additional secret as the AAD in Poly1305. This prevents forgery as
the secret is now required to make the MAC check pass.

Ultimately this means that no one can ever build a blinded path
which terminates at an LDK node that we'll accept, but over time
we've come to recognize this as a useful property, rather than
something to fight. Here we finally break from the spec fully in
our context encryption (not just the contents thereof).

This will save a bit of space in some of our `MessageContext`s,
though sadly not in the blinded path we include in `Bolt12Offer`s,
so they're generally not in space-sensitive blinded paths.

We can apply the same logic in our blinded payment paths as well,
but we do not do so here.

This is basically done, the only step left is to change the public API to take in a new key, rather than using the constant [41; 32]. Someone with an LLM agent setup properly can probably make it do the work.

[ldk-reviews-bot]

👋 Hi! I see this is a draft PR.
I'll wait to assign reviewers until you mark it as ready for review.
Just convert it out of draft status when you're ready for review!

[TheBlueMatt]

Okay, I tweaked this PR so that it can authenticate forwarding hops in blinded paths. It still needs someone (or an LLM?) to pick it up and pipe the auth key through from the blinded path builders to the crypto routines, then we can go drop most of the context validation in existing onion message handling, but I think the crypto part works.

[valentinewallace]

I'm not sure on the exact PR order yet, but will try to pick this up soon to unblock async payments since we already removed the preexisting validation scheme usage in #3618.

Edit: this is no longer blocking async payments, will just re-add the to-be-deprecated validation fields to the relevant async payments messages if needed