add _validateExtParams

[koo-virtuals]

Note

Medium Risk
Adds stricter extParams validation to BondingV5.preLaunch, which will now revert for non-canonical/misaligned or longer-than-32-byte payloads, potentially affecting existing integrators that sent loose encodings. Logic is simple but sits on the token-creation path and changes accepted input semantics.

Overview
BondingV5 preLaunch now validates extParams up front via a new _validateExtParams, enforcing a strict versioned layout: only empty payloads (V0) or exactly 32 bytes (V1) are accepted, lengths must be 32-byte aligned, and the first word must be a canonical bool (0/1); anything else reverts with InvalidInput.

_decodeIsFeeDelegation is simplified to assume prior validation and just read the first word, and the test suite is expanded to assert acceptance for V0/V1 while rejecting misaligned lengths, non-canonical bool words (including an ASCII "0x00.." attack payload), and unknown longer versions (64/96 bytes), plus preserving isFeeDelegation behavior across launch authorization.

^{Reviewed by Cursor Bugbot for commit 846f720. Bugbot is set up for automated code reviews on this repo. Configure here.}