trees/checkpoint: Add checkpoint.Checkpoint

[beautifulentropy]

Add Checkpoint to represent a tlog-checkpoint note body, with .String() to serialize it and .Marshal() to serialize with field validation. Add Parse() to parse an unsigned body and Open() to verify a signed note and parse its body into a Checkpoint.

A note to reviewers: this package and its tests were written with assistance from Claude Opus 4.8. That being said, it has been reviewed and extensively revised by myself before submission.

[jsha]

Generally looks good, thanks for working on this. Sharing something that confused me, in hopes it helps other reviewers:

The signed note format defines different signature types:

• 0x01 — Ed25519 signatures as specified by this document.
• 0x04 — Timestamped Ed25519 checkpoint cosignatures, as specified by c2sp.org/tlog-cosignature.
• 0x06 — Timestamped ML-DSA-44 (sub)tree cosignatures, as specified by c2sp.org/tlog-cosignature.

We want 0x04, 0x06, or both - but probably just 0x06. Importantly, 0x06 specifies a transformation to cosigned_message before signing / verifying.

We can implement our own note.Verifier that does the transfomation at verification time, and I'm assuming that's the intended followup from this PR.

Right now the tests use note.NewVerifier, which creates a key of type 0x01. Once we implement a verifier for 0x06, we'll probably want to update the tests for verisimilitude.

[jsha]

Oh, one other nit: This PR, in the description and comments, refers to the "note body", but https://github.com/C2SP/C2SP/blob/main/signed-note.md calls the same concept the "note text". We should use "note text" or "text" here too, with "note" or "signed note" for the overall object.

[aarongable]

LGTM with one comment. The new clarity on when to use Unmarshal vs when to use Open is really great!

[jsha]

Basically ready to go; a few small comments. Thanks for working on this!