fix(security): validate extensions PDA in deposit processor

[dev-jodee]

Summary

• Add validate_extensions_pda() call to the deposit processor before reading hook extensions, matching the existing validation in the withdraw processor
• Prevents an attacker from passing an empty/system-owned account as the extensions parameter to silently bypass all configured pre- and post-deposit hooks

Details

The deposit instruction reads hook configuration from the extensions account but did not validate that it is the correct PDA ([b"extensions", escrow_key]). An attacker could pass any zero-length account (e.g., system program) as extensions, causing get_extensions_from_account to return no hooks and silently skip all pre/post-deposit hook invocations.

The withdraw processor already validates this at withdraw/processor.rs:39. All extension-writing instructions (SetHook, SetArbiter, AddTimelock, BlockTokenExtension) and AllowMint also validate the extensions PDA. Only Deposit was missing this check.

Ref: GHSA-735q-4mm8-3j4w

Test plan

• just build succeeds
• just integration-test — all 178 tests pass
• Verify existing deposit+hook tests still pass (covered by suite above)
• Verify deposit with spoofed extensions account is rejected (needs new test)