fix: harden deps UTF-8 and split registries

[success-OG]

closes #318
closes #346
closes #367

PR description:

Summary

• Dependency key UTF-8 panic: dependency_key in dependency_registry.rs no longer .unwrap()s from_utf8 on user-supplied CID/URL/contract buffers. Invalid UTF-8 now maps to ContractError::InvalidProjectData, so add_dependency / update_dependency / remove_dependency fail cleanly instead of host-panicking.
• Bug bounty directory: Removed the broken empty bug-bounty gitlink (mode 160000, no .gitmodules) and replaced it with a normal bug-bounty/README.md covering scope, reporting, response targets, severity guidance, and safe harbor.
• Registry module splits: Converted monolithic registry files into submodules that separate validation/state-machine logic from storage mutations, while re-exporting the same public types so lib.rs / callers stay unchanged.

Module layout

Verification (verification_registry/)

• state_machine.rs — VerificationStateMachine + unit tests
• validation.rs — VerificationValidation (evidence CID checks)
• storage.rs — VerificationRegistry (request/approve/reject, renewal, assignment, history)
• mod.rs — re-exports

Review (review_registry/)

• validation.rs — ReviewValidation (CID, rating, owner-review guard)
• storage.rs — ReviewRegistry (CRUD, moderation, aggregates, listing/sort)
• mod.rs — re-exports

Test plan

• Call dependency APIs with malformed external CID/URL bytes → expect InvalidProjectData, not panic
• Confirm bug-bounty/README.md is a real tracked directory (not a gitlink) after commit
• Smoke existing verification + review flows (request/approve, add/update/list reviews)
• Run cargo test once preexisting utils.rs issues are fixed (ignored per request)

[drips-wave]

@success-OG Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits