fix(txbuilder): allow native-script CC certificates without a redeemer

[emmanuel-musau]

Allows .authCommitteeHot() and .resignCommitteeCold() to build CC certificates whose cold credential is a native (multisig) script. These are authorized by vkey witnesses, not a redeemer, so requiring one made ledger-valid certificates unbuildable. A redeemer is now required only for Plutus-script cold credentials, one supplied for a native script is pruned.

Closes #448

Blocked on #447

[solidsnakedev]

Nice fix, and reusing the validateVoterRedeemers shape here keeps it consistent. A few practical things:

1. This looks stacked on fix(txbuilder): allow native-script DRep certificates without a redeemer #447, so let's line them up before merge. The DRep changes and the native-script-drep-registration changeset in this diff are really fix(txbuilder): allow native-script DRep certificates without a redeemer #447's, showing up because the diff is against main. Cleanest path is to land fix(txbuilder): allow native-script DRep certificates without a redeemer #447 first and rebase this so the DRep bits drop out; or if you'd rather this one supersede fix(txbuilder): allow native-script DRep certificates without a redeemer #447, close fix(txbuilder): allow native-script DRep certificates without a redeemer #447 and keep everything here. Either works, just not both landing independently.

2. On the tests: they all go through .attachScript(), but makeIsNativeScript also classifies the native script when it comes in via a reference input. Might be worth a case for that path too, unless you're covering it somewhere I missed.

3. One to think about: validateCertRedeemers runs for the DRep and CC certs. Did you consider whether script-controlled stake certs (deregistration/delegation) need the same treatment, or are those covered elsewhere? Not saying they should be in this PR, just flagging it in case it's worth a look.