feat(oid4vc): revoke and reactivate by holder did:key

In case someone compiles and deploys a 32-bit algod (which we consider
unsupported) it would be good if our code has no _known_ issues.
These changes fix some possibilities, and make others easier to
analyze so they can be ignored.  (Analyzer will follow-up as separate
PR.)

The websocket and p2p networks route peer HTTP requests through
http.ServeMux, and the block, ledger and txsync services read their
path values with Request.PathValue. cmd/catchupsrv and the tests that
build their own routers move with them, since a handler reading
PathValue only works behind ServeMux. As in KMD, a catch-all "/" route
returns 404 without a search of every method.

ServeMux cannot match part of a segment or apply a regex, so the block
and ledger patterns now name version 1 literally:

  /v1/{genesisID}/block/{round}
  /v1/{genesisID}/ledger/{round}

The handlers already rejected every other version. Peer-facing changes:
- /v2/... and /v1.0/... block and ledger requests return 404, not 400.
- The round is no longer limited to [0-9a-z] before the handler runs.
  ParseUint accepts uppercase, so /v1/g/block/A serves round 10, as
  /a does. Other characters, such as +a or -1, return 400, not 404.
- Registering the same pattern twice panics, where gorilla kept the
  first. Production code registers each path once per network;
  TestLedgerServiceP2P registered the ledger path twice and no longer
  does. TestServicePathsShareServeMux registers every service pattern
  on one ServeMux to catch conflicts.

No package imports gorilla/mux any more, so it leaves go.mod.

chore(ci): ignore verified gitleaks false positives

chore(ci): ignore verified gitleaks false positives

Route the KMD API with the standard library's ServeMux. Each v1 route
is registered with its method and wrapped in the auth and request
callback middleware once, at startup, rather than on every request.
OPTIONS, CORS and PNA middleware wrap the whole mux. A catch-all "/"
route returns 404, which spares ServeMux a search of every method on
each unmatched request.

All 21 v1 routes, their methods and auth are unchanged. Observable
differences:
- A wrong method or unknown path returns 404. Paths outside /v1
  previously returned an empty 405.
- CORS and PNA headers are also sent on 404s and redirects.
- Unclean paths such as /v1//wallets redirect with 307, not 301.
- OPTIONS on an unclean path returns 200 instead of redirecting.
- HEAD /v1/wallets is routed to the GET handler, so it returns 401
  without a token instead of 404.
- /v1/wallet%2Finfo returns 404; gorilla matched the decoded path.