fix(github): enforce persona/pubkey match and verify against server-computed payload

[prasanna8585]

Summary

Two coupled issues in the GitHub validator (validator/github/github.go):

1. The public key recovered from the Gist's persona field (payload.Persona) was never asserted to match the avatar key supplied in the upload request (gh.Pubkey, from the embedded validator.Base).
2. The final signature check used payload.SignPayload -- content taken directly from the attacker-controlled Gist -- instead of gh.SignaturePayload, the payload the server itself computes (line 88, gh.GenerateSignPayload()) and expects to have been signed.

Together, this allows an account owner to attach a self-signed but forged sign_payload (arbitrary uuid/created_at/prev values) to their own GitHub proof, corrupting metadata written to the proof chain and Arweave. Per platform review, this does not allow cross-account takeover or persistent metadata beyond the reporter's own persona.

Fix

• Assert the recovered pubkey matches the request's declared pubkey via crypto.CompressedPubkeyHex.
• Verify the signature against the server-computed gh.SignaturePayload (already computed at line 88, just previously unused for verification) rather than the Gist-supplied value.