feat(wasm-utxo): add signing support for shielding transactions

[veetragjain]

Lets the client derive out_ciphertext's ovk on the fly as the ECDH agreement of the BitGo cosigner pubkey and its own signing privkey, instead of the server ever holding or seeing it.

• ironwood_build: derive_client_ovk (ECDH) and compute_out_ciphertext (re-encrypt out_ciphertext under it), backed by real on chain shield1zec fixture data and a zebra-chain decrypt cross-check.
• ironwood_pczt: with_out_ciphertext splices the re-encrypted field into an already-serialized PCZT.
• ZcashBitGoPsbt: set_ironwood_out_ciphertext (guarded so it can't run after a transparent signature exists, since out_ciphertext is sighash-committed) and sign_ironwood_v6, which resolves the signing key via bip32_derivation, finalizes out_ciphertext on the first signing round, and signs the ZIP-244 transparent sighash directly, the v6 counterpart to the generic sign(), which still rejects v6 PSBTs outright.

Ticket: CSHLD-1377

[linear-code]

CSHLD-1377