keypair: validate payload length in ParseAddress to prevent panic

[karthikiyer56]

strkey.Decode() accepts payloads of any length with valid checksums. Without length validation, short G-addresses could pass ParseAddress() and later cause panics in Hint() or Verify() methods.

Add explicit 32-byte length check in newFromAddress() to reject malformed addresses early with ErrInvalidKey.

Fixes #5901

[Copilot]

Pull request overview

This PR hardens keypair.ParseAddress() against malformed G-addresses by validating the decoded payload length before constructing an ed25519.PublicKey, preventing downstream panics in Hint()/Verify() when given short/long payloads.

Changes:

• Add an explicit 32-byte payload length check in newFromAddress() and return ErrInvalidKey on mismatch.
• Add unit tests covering short payload, long payload, and valid 32-byte payload cases for ParseAddress().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
keypair/from_address.go	Adds payload length validation after strkey.Decode() to reject malformed addresses early.
keypair/from_address_test.go	Adds regression tests ensuring ParseAddress() rejects non-32-byte payloads and accepts valid payloads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

@karthikiyer56 I've opened a new pull request, #5910, to work on those changes. Once the pull request is ready, I'll request review from you.