[TGE] Migrate minting from caller-supplied token ids to `networkId` + `salt`

[ristik]

Summary

Update the SDK mint path so the mint transaction carries a network id and a 32-byte salt, while TokenId becomes a derived value:

tokenId = SHA-256(CBOR(salt, networkId))

Scope

• Add a small NetworkId/network constants helper:
  • mainnet 1
  • testnet 2
  • local development 3
  • reject 0 in safe builders.
• Add a TokenId.fromSalt(networkId, salt) or equivalent helper.
• Change MintTransaction so its protocol fields are:
  • networkId
  • recipient
  • salt
  • tokenType
  • justification
  • data
• Keep tokenId as a derived read-only getter for compatibility where practical.
• Update MintTransaction.create(...) to accept networkId and optional salt; generate a 32-byte salt by default.
• Update mint CBOR encode/decode to use networkId and salt instead of serializing tokenId.
• Update MintTransactionState.create(...), MintSigningService.create(...), and CertificationData.fromMintTransaction(...) to derive from the computed token id.
• Update split APIs so new split outputs are described by salts, or by objects that expose both salt and derived tokenId; split tree leaves must use the derived token id for the same network as the source token.
• Update tests, functional flows, and examples that currently call TokenId.generate() for minting.

Acceptance Criteria

• Mint transactions no longer serialize a caller-supplied token id.
• The same salt on different network ids derives different token ids.
• MintTransaction.tokenId is derived from (networkId, salt).
• Existing transfer transaction format is unchanged.
• Existing certified transaction wrapper format is unchanged.
• Split output proofs are keyed by derived token ids, not arbitrary caller-supplied token ids.

Regression Tests

• Mint encode/decode round-trip preserves networkId and salt.
• TokenId.fromSalt(1, salt) !== TokenId.fromSalt(2, salt).
• Mint source state hash uses TokenId.fromSalt(networkId, salt).
• Mint signing key derivation uses the derived token id.
• Split token proof lookup succeeds with the derived child token id.