NUT-11: hash blinded outputs in SIG_ALL

[SatsAndSports]

Summary

• build on the length-framed SIG_ALL construction in NUT-11: typed, length-framed SIG_ALL message over output hashes #404
• commit to SHA256(B_) instead of revealing each raw blinded point to the signer
• require the mint to derive each output hash from the submitted B_
• regenerate swap and melt vectors and signatures

Point encoding

SHA256 is applied to the exact canonical raw point encoding decoded from the
B_ hex string. For secp256k1 this is the 33-byte compressed SEC1 encoding,
including the 0x02 or 0x03 parity prefix. It is not the 32-byte x-only
representation and not the UTF-8 hexadecimal representation.

Including parity ensures that B_ and -B_ have distinct commitments even
though they share an x-coordinate. Defining the preimage as the canonical raw
encoding also extends naturally to other point types.

Verification

• regenerated both framed transcripts and tagged hashes independently
• verified the new BIP-340 signatures
• ran npx prettier@3.9.1 --check 11.md tests/11-test.md

[SatsAndSports]

I've decided to close this PR that I made

I'm not against hashing the blinded outputs, and am happy for anyone else to advocate for this. It's just that I now have another solution (Unpoisonable Blinded Outputs) that fixes the poison issue directly, allowing us to keep using adverserial multi-party e-cash transactions (e.g. Spilman with non-interactive setup)