Fixes #6538

Key registration commands did not respect explicit `--fee=0` (or custom fees),
because libgoal functions `MakeUnsignedGoOnlineTx`, `MakeUnsignedGoOfflineTx`,
and `MakeUnsignedBecomeNonparticipatingTx` overwrite fee=0 with the suggested
network fee. Furthermore, `--fee` and `--tip` handling was duplicated across
clerk, asset, and application commands without a shared helper.

This change:
- Adds `applyFeeAndTip()` in `cmd/goal/common.go` to inspect whether `--fee`
  was explicitly passed via `cmd.Flags().Changed("fee")`, overriding the
  suggested fee with the user's explicit fee (including 0 for fee pooling),
  and applying `--tip` if present.
- Refactors `changeAccountOnlineStatus()`, `generateAndRegisterPartKey()`,
  `renewPartKeysInDir()`, and `markNonparticipatingCmd` to accept `*cobra.Command`
  and invoke `applyFeeAndTip()`.
- Unifies `clerk.go`, `asset.go`, and `application.go` to use `applyFeeAndTip()`.
- Adds unit tests in `account_test.go` covering default fees, explicit zero fee,
  custom fees, tip handling, and fallback behavior.

TealCompile matched any 58 character base32 string and kept matching, so the
last one won. compile now reports the salted address after the program hash,
which made the helper return the wrong one of the two, and every test that
funds the address it returns spent from an account it had not funded:
goalLogicSigTest, limitOrderTest and tealAndStatefulTealTest.

It keeps the first match now, which is the program hash it has always
returned. TealCompileSign is unaffected, since compile prints no address when
it is signing, and tealConsensusTest already stops at the first match.

Also add the t.Parallel that TestAuthorizeWithProgram was missing. cmd is the
one tree the paralleltest linter is not excluded from.

A program has two account addresses, so goal needs a way to say which one a
transaction is authorized by. --salted picks the salted one; without it, the
form is taken from whichever address the transaction's authorizer already
matches, and failing that the program hash, so that existing uses keep the
address and the behavior they had. That leaves --salted needed only where
nothing else settles it: clerk send -F with no --from and no --signer, where
the program's address becomes the sender.

Reading the form off the authorizer rather than the sender is what makes a
rekeyed account work: --signer names the authorizer, and that is the address
the program has to match.

LogicSigSanityCheck now covers whichever form a transaction uses, so goal
still checks a program before submitting it.

clerk send's -L branch built its transaction without the AuthAddr that -S had
asked for, while the -F branch beside it set one. Both now go through the same
path, so -L no longer silently drops --signer.

A transaction may now be authorized by a LogicSig carried in its PQsig under
the ls scheme, giving a program an account whose address is off the
Edwards25519 curve. The program stands in for the public key and its arguments
for the signature, so the address commits to the program: once the envelope
shows the authorizer is that program's address, evaluating the program is the
whole authorization, and there are no signature bytes to check.

The program is measured and priced exactly like one in Lsig. PQSig.Lsig()
hands back a LogicSig so the group size pool, the per-byte program surcharge
and the evaluator can treat both the same way. The scheme itself adds no fee
surcharge: a Falcon-style one would make the off-curve form cost more than the
on-curve form it exists to replace.

NewSigEvalParams decided whether to allocate the group's pooled LogicSig
budget by looking for programs in Lsig alone. An ls transaction has none
there, so without counting it each program would have started from a full
LogicSigMaxCost of its own.

Simulate's placeholder detection keys on empty signature bytes, which for an
ls PQSig means a program that takes no arguments rather than a proof yet to
come. Such a transaction is complete, and is now evaluated and traced instead
of being swapped for a proxy signature.

The algod admission checks need no change: rejectOnCurveLogicSigPrograms only
looks at programs in Lsig, and enforcePQAuthorizerCompliance already derives
its address from the PQSig, so it warns about a badly salted ls address the
same way it warns about a Falcon one.

A LogicSig program now has two account addresses: the program hash it has
always had, and the salted ls-scheme address that is guaranteed off the
Edwards25519 curve. Both are worth knowing before funding one, so clerk
compile prints both.

The new address goes at the end of the existing line rather than on one of its
own, because scripts read that line by field: e2e-app-simple.sh takes
${PROGRAM[1]} from a word-split capture and hdr-access-logicsig.sh pipes
through awk '{print $2}'. Both still see the program hash they expect.

basics.PQLogicSigAddress derives the address, and with it the salt, from the
program alone. Nothing needs to store the salt: it is the lowest one giving an
off-curve address, so a program's arguments and bytes are enough to rebuild
the whole authorization.

Bumps [axios](https://github.com/axios/axios) from 1.8.4 to 1.20.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.8.4...v1.20.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>