feat: support sharded canister ranges certificate structure

[shilingwang]

Summary

Adds support for the new sharded canister ranges certificate structure introduced in newer IC versions, while maintaining backwards compatibility with the old structure.

Changes

• ✨ Add support for new sharded structure at /canister_ranges/<subnet_id>
• 🔄 Maintain backwards compatibility with old structure at /subnet/<subnet_id>/canister_ranges
• 🧪 Update certificate builder to use new sharded structure for tests
• 🛡️ Handle empty canister ranges gracefully for local development
• 📦 Bump version to 3.0.4

Implementation Details

This follows the IC interface spec and ic-agent pattern for certificate verification.

The implementation:

1. First tries to look up canister ranges in the new sharded structure at /canister_ranges/<subnet_id>
2. Iterates through all shards and collects ranges from each
3. Falls back to the old structure at /subnet/<subnet_id>/canister_ranges if the new structure doesn't yield any ranges
4. Accepts empty ranges for local development scenarios

Testing

• ✅ All unit tests pass (10/10)
• ✅ Rust e2e tests pass
• ✅ JavaScript/WASM e2e tests pass

Related Issues

Resolves compatibility issues with newer IC versions that use the sharded certificate structure.

[r-birkner]

I don't understand this comment: the new agent supports the new sharded format. That's why we need to make this PR. What am I missing?

[shilingwang]

This is not correct. The old format work with the ts integration test and new format doesn't. I'll still looking into it.

[r-birkner]

Probably, we just need to update agent-js: https://github.com/dfinity/response-verification/blob/main/package.json#L17-L20

[r-birkner]

Let's add a comment here that we only fallback to the old structure because of JS and that once we bump agent-js, we can get rid of the old structure.

[r-birkner]

I see you introduced a new error: CanisterRangesNotFound. Previously, we used SubnetCanisterIdRangesNotFound. It doesn't really matter, but maybe we can remove one or the other such that we only have one.

[r-birkner]

It would be nice to make use of functional iterators (more rust). something like:

let canister_ranges: Vec<(Principal, Principal)> = match cert.tree.lookup_subtree(&canister_ranges_path) {
    SubtreeLookupResult::Found(subnet_tree) => {
        // Use an iterator to transform paths into parsed data
        subnet_tree
            .list_paths()
            .into_iter()
            .filter_map(|path| {
                let key = path.first()?;
                if let LookupResult::Found(data) = subnet_tree.lookup_path([key.as_bytes()]) {
                    Some(parse_cbor_principals_array(data))
                } else {
                    None
                }
            })
            .collect::<Result<Vec<Vec<_>>, _>>()?
            .into_iter()
            .flatten()
            .collect()
    }
    SubtreeLookupResult::Absent | SubtreeLookupResult::Unknown => {
        let old_path = [
            b"subnet".as_slice(),
            delegation.subnet_id.as_ref(),
            b"canister_ranges".as_slice(),
        ];

        match cert.tree.lookup_path(&old_path) {
            LookupResult::Found(data) => parse_cbor_principals_array(data)?,
            LookupResult::Unknown => Vec::new(),
            LookupResult::Absent | LookupResult::Error => {
                return Err(CertificateVerificationError::CanisterRangesNotFound {
                    path: canister_ranges_path.iter().map(|p| p.to_vec()).collect(),
                });
            }
        }
    }
};