Add immutable per-party GG20 transcript modes

[lrsaturnino]

Summary

• require an explicit legacy or security-v2 transcript mode for every ECDSA keygen/signing party
• freeze the selected mode at local-party construction
• reproduce the historical untagged DLN, range, Bob, factor, modulus, and Schnorr proof transcripts in legacy mode
• retain session-bound/domain-tagged challenges and the per-ceremony nonce requirement in security-v2 mode
• keep validation and memory-safety hardening active in both modes
• add exact historical-challenge regressions and homogeneous keygen/signing coverage for both modes

This is a draft because the transcript boundary needs independent cryptographic review before release use.

Verification

• go test ./...
• go test -race ./tss ./crypto/dlnproof ./crypto/mta ./crypto/paillier ./crypto/schnorr ./ecdsa/keygen ./ecdsa/signing
• go vet ./...