Add light client chain specifications for Zagros (#78)

light-client/zagros.json and light-client/people-zagros.json are what the
wallet's embedded light client starts from.

The full specifications carry the raw genesis storage, about 3 MB each.
These carry only the genesis state root, which identifies the chain:
- The relay specification adds a checkpoint (lightSyncState) exported by
  the relay node through sync_state_genSyncSpec. It is 7.3 KB.
- People has no checkpoint, because the relay chain's finality covers it.
  It is 732 bytes.

Boot nodes put the /wss addresses on 443 first and keep the plain TCP ones.

scripts/light_client_specs.py writes both files. It checks every state root
by rebuilding the genesis header and comparing its hash with the chain's
genesis hash. A root with one byte changed is refused.

The checkpoint is a trust anchor: a client that starts from a false one can
follow a false chain. It reaches the wallet inside the APK or through
signed/targets.json, never from peers. Targets are re-signed (version 3,
689 files).

The secret scan lets through the four public chain-data keys these files
carry: stateRootHash, finalizedBlockHeader, babeEpochChanges and
grandpaAuthoritySet.

.github/workflows/security.yml

@@ -57,8 +57,10 @@ jobs:
           FOUND=0
 
           echo "Checking for private keys in config files..."
-          # "account" fields hold public 32-byte account IDs (balance-test fixtures), not private keys
-          if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions\|\"account\":"; then
+          # "account" fields hold public 32-byte account IDs (balance-test fixtures), not private keys.
+          # The light client specifications carry public chain data: the genesis state root and the
+          # relay chain checkpoint (an encoded finalized header, BABE epochs, GRANDPA authorities).
+          if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions\|\"account\":\|\"stateRootHash\":\|\"finalizedBlockHeader\":\|\"babeEpochChanges\":\|\"grandpaAuthoritySet\":"; then
             echo "::error::Possible private key found"
             FOUND=1
           fi