Add Security Considerations to spec and cryptographic chain verification

[bradleygauthier]

Summary

• Adds CPS Section 7 (Security Considerations) to the protocol spec, documenting what CPS provides (integrity, authenticity, non-repudiation, ordering, quantum resistance) and what it does not (confidentiality, truthfulness, availability, identity binding). Covers signer key compromise, chain truncation, verification levels, replay, and timestamp trust.
• Extends chain.verify() in both Python and TypeScript with optional cryptographic verification: recompute SHA3-256 from content and (Python) verify Ed25519 signatures. Default structural-only behavior is unchanged (backward compatible).
• Updates CHANGELOG to reflect all additions since v1.2.0.

Type of Change

• New feature (non-breaking change that adds functionality)
• Protocol change (modifies the CPS specification)
• Documentation update
• Test improvement

Checklist

Python reference (reference/python/)

• Tests pass: cd reference/python && pytest tests/
• Linter passes: cd reference/python && ruff check src/ tests/
• Type checker passes: cd reference/python && mypy src/qp_capsule/
• Golden fixtures pass: cd reference/python && pytest tests/test_golden_fixtures.py

TypeScript reference (reference/typescript/)

• Tests pass: cd reference/typescript && npm test
• Type check passes: cd reference/typescript && npx tsc --noEmit
• Conformance passes: cd reference/typescript && npm run conformance

General

• Documentation updated (if applicable)
• CHANGELOG.md updated (if user-facing change)

Protocol Impact

• Protocol change (requires CPS version bump and golden fixture update)

New Section 7 shifts URI Scheme to Section 8. No changes to serialization, hashing, or sealing — golden fixtures remain valid.