Compare mustMatch/ifNotIn values numerically and keep hidden bundle slots

[manuelwedler]

Summary

Fixes problems 2 and 3 from ethereum/clear-signing-erc7730-registry#2598 (see this comment).

• Numeric mustMatch / ifNotIn comparison. Decimal strings and JSON numbers in the descriptor now compare as integers against decoded calldata words and EIP-712 message values. Signed int arguments compare as two's complement, so "-1" works. Hex literals compare case-insensitively, so checksummed addresses match lowercase decoded addresses. Full hex words used by existing descriptors still match as before.
• Hidden fields inside bundled groups. A hidden array element now keeps an empty bundle slot instead of being dropped. Bundled groups that contain mustMatch or never fields no longer fail the equal-length check. Applied to both the calldata and EIP-712 engines.

Tests

Six new spec compliance tests:

• Calldata mustMatch with decimal strings and a checksummed address, plus the mismatch error path
• Calldata ifNotIn with a JSON number
• Calldata mustMatch on int256 with "-1" and with a full hex word
• EIP-712 mustMatch with a JSON number, a short hex literal, and a checksummed address
• Calldata and EIP-712 bundled groups containing a mustMatch field and a never field

cargo test passes (443 tests), cargo fmt --check is clean, UniFFI feature build compiles. Clippy is clean for the library and spec test target. A pre-existing clippy error in safe_integration.rs on main is unrelated and untouched.