use prevalidate proof in validate_unsigned

[n13]

this prevents fake proofs from getting into the chain

Wormhole proof pre-validation before transaction pool entry

Unsigned wormhole proof extrinsics previously only checked for non-empty bytes before entering the tx pool, making it trivial to DDoS by spamming random byte sequences.

Changes

Extract pre_validate_proof helper in the wormhole pallet that runs all cheap checks -- proof deserialization against circuit common data, public input parsing, asset ID, volume fee rate, block hash existence/match, and nullifier replay -- and call it from both validate_unsigned (pool gating) and the dispatch function (defense-in-depth), eliminating duplicated validation logic.

What this prevents

Random bytes and malformed proofs are now rejected at pool entry before propagation. Deserialization against the circuit's CommonCircuitData is the strongest filter -- an attacker would need to reverse-engineer the embedded circuit structure just to get past it. The full ZK verification remains at dispatch time only to avoid becoming a CPU-exhaustion vector itself.