blockchain: Implement stricter bounds checking.

[aarcamp]

This updates the deserialization logic underneath the decodeSpentTxOut function to be more robust, including the addition of explicit bounds checks to prevent panics. In at least one case (txVersion parsing), existing bounds checks were incorrect (e.g., testing for impossible conditions).

A minor rearrangement was also done to eliminate one call to the decodeFlagsFullySpent helper.

Although empty scripts are permitted, decodeCompressedTxOut was missing logic to ensure the script version field actually exists (defaulting to 0x00 only via Golang variable initialization).

To support these changes, the TestStxoDecodeErrors test suite was updated to more closely match the updated logic, and to add new tests for error conditions.

According to "go test -coverprofile", coverage for chainio.go increased from 84.0% to 84.4%.

[davecgh]

Very nice job on this! I only spotted one potential issue and left an inline comment.

In addition to thoroughly reviewing the changes to the code itself, I also manually went through all of the newly added tests to verify they lined up with the comments and were hitting the expected error paths.

[davecgh]

Looks good. I'll squash it into a single commit during the merge.