fix: support truncated hashes based on multihash length

[2color]

Description

• Added logic to handle truncated multihashes during verification in networked storage
• Enhanced hash verification to work with partial hash values
• Added test to cover truncated hash scenario

Background

Originally reported in https://ipshipyard.slack.com/archives/C0238P3SU4X/p1753096031053949

Change checklist

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation if necessary (this includes comments as well)
• I have added tests that prove my fix is effective or that my feature works

[aschmahmann]

Doing this without sufficient checks is not a good idea from a security perspective. Go has https://github.com/ipfs/boxo/tree/main/verifcid to help stop people from ending up in unsafe situations, it's used in places where you'd be importing data into the system whether the data is locally imported or coming from the network.

For some history on this see ipfs/kubo#4371 and linked issues / PRs.

[achingbrain]

I've opened multiformats/js-multiformats#329 (and multiformats/js-multiformats#328 for discussion) which implements this in multiformats and allows specifying limits on a per-hash basis (defaulting to https://github.com/ipfs/boxo/blob/main/verifcid/cid.go#L17-L20).

Here we would then just need to do:

const res = hasher.digest(block, {
  truncate: cid.multihash.size
})

...and it would throw if the truncation is too long/short/not allowed.

[2color]

Closing in favour of multiformats/js-multiformats#329

[achingbrain]

multiformats/js-multiformats#329 has shipped so this can be accomplished via this now:

const res = hasher.digest(block, {
  truncate: cid.multihash.size
})

[agmap]

Just a question 🤔:
Does this PR now needs to reopen after multiformats has shipped?
@2color @achingbrain