[LOW] Protect Ed25519 key objects from external mutation

[OskarEichler]

Summary

• duplicates and freezes internal seed, keypair, and public-key material
• returns defensive copies from serialization readers
• prevents caller-owned or returned strings from changing live signing and verification state

Security impact

Severity: LOW. VerifyKey currently retains the caller's mutable string and returns the same object from to_bytes. Code that keeps or receives that string can replace the trusted verification key after construction; a signature from the replacement key is then accepted. SigningKey exposes similar mutable internal state, which can corrupt its serialized identity or future signatures.

Exploitation requires access to a mutable string already shared with the key object. This does not reveal secret key material beyond the gem's existing serialization API and does not permit forging signatures for an unchanged key.

Reproduction

On 1.4.0/current main, construct a verifier from trusted key bytes, retain that input string, replace its contents with an attacker public key, then verify an attacker signature. Verification succeeds because the verifier's internal key changed through the retained reference.

Verification

• focused mutation model: baseline accepts the attacker signature; this branch rejects it and preserves the original key
• Ruby 4.0.6: 12 examples, 0 failures; 15 files linted, 0 offenses
• Ruby 3.2.11: 12 examples, 0 failures
• full 17-job upstream CI matrix passed, including MRI 3.0-4.0, JRuby 9.4/10, TruffleRuby, Linux, Windows, and lint
• gem package build and git diff --check passed

Compatibility and limitations

Breaking-change note: callers can still serialize and mutate the returned strings, but those mutations no longer modify the existing key object. Code that intentionally relied on this undocumented aliasing behavior must construct a new key object after changing bytes.

This patch does not alter Ed25519 verification semantics, ref10/ZIP-215 compatibility, signature canonicality, provider selection, or cryptographic arithmetic.