Upgrade btcd and migrate to btcec/v2

[mswilkison]

The current btcd version is covered by three published Dependabot advisories. Upgrade it to v0.24.2 and migrate the removed legacy btcec and btcutil imports to btcd/btcec/v2 v2.2.0 and btcd/btcutil v1.1.5. This covers GHSA-2chg-86hq-7w38, GHSA-3jgf-r68h-xfqm, and GHSA-27vh-h6mc-q6g8.

Stacked on #20; merge #19, then #20, then this PR. The combined stack selects versions at or above the fixed versions for all 30 current Dependabot alerts. Dependency selection was checked against each alert's published affected range; this is not a claim that all affected dependency paths are reachable in tss-lib.

The migration preserves compressed public-key parsing, the caller-supplied curve instance in derived keys, the registered secp256k1 name, and coordinate-based JSON/Gob persistence. Compatibility tests use fixed legacy encodings, synthetic save data with no signing secrets, ordinary point arithmetic, BIP32 vectors, hierarchy deltas, and curve registry controls. No legacy btcec or btcutil packages remain in the compiled library/test dependency closure.

This PR is a draft pending downstream integration review. Exported elliptic.Curve signatures remain the same, but the concrete curve implementation changes from legacy btcec to Decred secp256k1/v4 through btcec/v2. Callers using legacy imports or concrete type assertions need adaptation. The selected btcd/btcec/btcutil versions match the public keep-core dependency set referenced by keep-core #4312; that PR also supplies the Go baseline used by #20. This does not establish keep-core integration compatibility, and Go module version selection in consumers can choose a higher btcec/v2 version.

Validation on the final stacked commit with Go 1.26.8:

• Full tss, crypto, crypto/ckd, crypto/schnorr, crypto/vss, and ecdsa/signing package suites passed, including ordinary and HD signing end to end (signing: 67.601s).
• Legacy save-data compatibility and bounded existing keygen controls passed (9.959s). Full keygen remains for CI.
• Legacy compatibility goldens passed on both the original dependency and the migrated implementation.
• go build -mod=readonly -p 1 ./..., go vet -mod=readonly -p 1 ./..., go mod verify, module tidiness, and whitespace checks passed.
• An independent review passed focused serialization, derivation, registry, and signing controls on the migration candidate; migration source/tests/fixtures are unchanged by stacking.

The exact minimum Go toolchain was not exercised locally. Full repository CI was dispatched explicitly at 66aaeca3344b1977d2d2c20f6fd98c521bc58bbe because this stacked PR targets a branch other than master: full tests, formatting.