Prepare certificate verifier target dispatch

[jasisz]

Summary

• make certificate identity checking return an explicit accepted artifact target
• route artifact validation/hash/core-module bytes through a target-aware preparation helper
• keep schema 5 behavior unchanged: only wasm-gc is accepted and wasip2 remains fail-closed before wasm validation

Refs #1146

Tests

• cargo fmt --all -- --check
• cargo test -p aver-cert
• cargo test --features wasm,certify --test cert_verify_spec cert_tripwire_declines_unsupported_artifact_target -- --nocapture