fix(js-legacy): decode the correct signers in WithdrawWithheldTokensFromAccounts

[latent-9]

What

decodeWithdrawWithheldTokensFromAccountsInstruction returns the wrong signers accounts. With no multisig signers it reports the source accounts as signers, and with multisig signers it truncates them to the number of sources.

Why

The decoder sizes the signers slice with numTokenAccounts, which the encoder sets to sources.length:

signers: keys.slice(3, 3 + numTokenAccounts),

createWithdrawWithheldTokensFromAccountsInstruction lays out the keys as [mint, destination, authority, ...signers, ...sources] (it calls addSigners, then pushes the sources) and encodes numTokenAccounts = sources.length. So the signers run from index 3 up to keys.length - numTokenAccounts, not 3 + numTokenAccounts. The two only coincide when the signer count equals the source count.

With 2 source accounts:

• 0 signers: signers decodes as the 2 source accounts instead of [].
• 3 signers: signers decodes as the first 2, dropping the third.

Change

• Slice signers up to keys.length - numTokenAccounts so it covers exactly the multisig signers.
• Add round-trip tests that build the instruction with the encoder and assert the decoded signers and sources, for both the single-authority and the multisig case.

Verification

Ran in clients/js-legacy: pnpm run build, pnpm run lint, pnpm run format, and mocha test/unit all pass. The new tests fail on the current code and pass with the fix.