Sidecar inclusion updates

[realbigsean]

Issue Addressed

There are a few gossip rules we needed to add/update, they're included here:

• signature verify the header in each blob - this can/should maybe be extended to use a cache? so we aren't verifying the same signature up to 7 times. But I'll leave that for a follow up PR
• The gossip duplicate rule has been updated:
  before:

- _[IGNORE]_ The sidecar is the only sidecar with valid signature received for the tuple `(sidecar.block_root, sidecar.index)`.

after:

- _[IGNORE]_ The sidecar is the first sidecar for the tuple (block_header.slot, block_header.proposer_index, blob_sidecar.index) with valid header signature, sidecar inclusion proof, and kzg proof.

• a check has been added to verify the block header is a descendant of the finalized checkpoint

Future Improvements

There's more and more overlap between gossip blob and block gossip verification, it'd be nice if we could unify all overlapping logic

[pawanjay176]

Nice catch on the updated gossip rules.
I had some clarifications on the descended from finalized rules

[pawanjay176]

I think this condition should be after the proposer signature verification.
Else it would be possible for an attacker to spam us with useless blobs with bogus non-canonical parent roots and make us do a bunch of database reads.

[realbigsean]

So this one I just copied from block_verification.rs. It's also before the proposer signature check, although I'm not sure why. I was thinking It might be nice to consolidate the blob_verifcation and block_verifcation code because we can do a lot of the same checks over SignedBlockHeader.

[pawanjay176]

I'm not completely sure I understand requesting the parent in this case.

[realbigsean]

Similar to the other comment, I was following the lead of block_verification, I think here it's because we're checking if the parent root exists, not the block root related to the current message