xdr: Add zero-copy XDR view types and code generator - #5937

Introduces a zero-copy view API over XDR bytes: every XDR type has a
corresponding View type that is a typed []byte alias. Views expose
accessor methods that navigate into sub-slices without allocating,
unmarshaling, or copying — enabling consumers to read a few fields out
of a large encoded value (e.g., LedgerCloseMeta) at a fraction of the
cost of a full decode.

Structure:
- xdrgen/ — Go-based code generator. Reads a JSON IR emitted by the
  rust generator-definitions-json tool, produces xdr/xdr_views_generated.go.
  The generator itself uses an inlineable array-traversal helper to
  ensure generic dispatch doesn't sneak into hot paths.
- xdr/xdr_views_generated.go — Generated view types and runtime support
  (primitive views, error types, Try/TryVoid panic-catching helpers).
- xdr/views_api.md — API design document covering the view model,
  method shapes, and consumer patterns.
- Makefile — `xdr/xdr_views_generated.go` target runs the two-stage
  pipeline (rust IR emitter in docker, Go xdrgen) to regenerate views
  from .x files.

Tests and benchmarks:
- xdr/xdr_view_test.go — round-trip integration test on a hand-built
  LedgerCloseMeta.
- xdr/view_support_test.go — focused tests for runtime helpers:
  safeUint32ToInt overflow, BoolView invalid discriminants, VarOpaqueView
  edge cases (empty, truncated, non-zero padding), arrayViewCount bounds,
  Try/TryVoid panic recovery, ViewError formatting.
- xdr/view_randxdr_test.go — property-style tests on randxdr-generated
  LedgerCloseMeta. RawRoundTrip proves the top-level slice matches input;
  AccessorCorrectness navigates to a struct field and a variable-array
  element and compares sub-view Raw() against value-side MarshalBinary().
- xdr/view_fuzz_test.go — FuzzLedgerCloseMetaView with seed corpus from
  a real ledger fixture plus randxdr-generated ledgers. Asserts no panic
  on ValidateFull, Raw, or field navigation for arbitrary bytes.
- xdr/event_extraction_bench_test.go, xdr/extract_tx_bench_test.go,
  xdr/selective_decode_bench_test.go, xdr/try_bench_test.go —
  benchmarks comparing view-based access vs full-decode on a committed
  real ledger fixture (xdr/testdata/ledger_58752000.bin).

This PR covers only the view implementation and tests. Consumer-side
integration (wiring views into BufferedStorageBackend for real ingest
paths) is a separate follow-up PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Two defensive fixes for malformed IR input (codegen-time, trusted source
in practice but cheap to harden):

- resolveTypeRef now returns (*TypeRef, error) and uses a visited-set to
  detect cyclic typedef chains (e.g., typedef A B; typedef B A;) instead
  of looping forever. caseValueExpr propagates this error through
  planUnion.

- sizeVal returns (uint32, error) and rejects values exceeding
  math.MaxUint32 instead of silently truncating. Callers in
  BuildViewType wrap with field-context messages.

Addresses reviewer feedback on PR stellar#5937.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>