fix(crypto): keep VRF private key material out of debug output

[erubboli]

Problem

VRFPrivateKey, VRFPrivateKeyHolder and SchnorrkelPrivateKey derived Debug, which prints the full secret key material (the schnorrkel scalar and nonce in decimal). Since these types end up in the parsed command line options (e.g. a user-supplied --chain-genesis-staking-settings VRF key), a single {:?} of the options at startup wrote the complete secret to the node log.

ZeroizeOnDrop does not address this: the schnorrkel secret already wipes itself on drop, but Debug still prints it in full beforehand.

Change

• Remove Debug from the derives of VRFPrivateKey, VRFPrivateKeyHolder (crypto/src/vrf/mod.rs) and SchnorrkelPrivateKey (crypto/src/vrf/schnorrkel/mod.rs) and add hand-written Debug impls that render <redacted>.
• Add tests pinning the exact redacted rendering for each type.

Testing

• cargo test -p crypto --lib (136 passed)
• ./do_checks.sh