aztec: `hash` is computed insecurely

[olehmisar]

wormhole/aztec/contracts/src/main.nr

Lines 405 to 407 in 980c540

	// Safety: verify_vaa_unconstrained performs parsing and validation that doesn't need constraints
	let (pub_keys_x, pub_keys_y, signature_bytes_array, hash, _signatures_len) =
	unsafe { verify_vaa_unconstrained(bytes, actual_length) };

if it's unconstrained, it's "trust me bro" level of security. Anybody can call verify_vaa(invalid_vaa) and spoof the hash variable with any valid hash that was signed by the guardian network.

Treat any unconstrained code as a user/hacker input.

Useful read: https://gist.github.com/olehmisar/4cfe6128eaac2bfbe1fa8eb46f0116d6