fix(verification): use remote master key in ConfirmSAS

[underhax]

Summary

Fixes cross-user SAS verification failure (failed to trust keys: master keys do not match) when the remote user confirms the SAS emojis before the local user does.

Problem Description

In verificationhelper, cross-user (cross-account) SAS verification fails with failed to trust keys: master keys do not match if the remote user confirms the SAS emojis before the local user does. If the local user confirms first, the verification succeeds.

This happens because the local ConfirmSAS function mistakenly passes the local user's master key to trustKeysAfterMACCheck, which expects the remote user's master key for cross-signing verification.

Root Cause

In ConfirmSAS, masterKey was populated with the local user's own master key:

crossSigningKeys, err := vh.mach.GetOwnCrossSigningPublicKeys(ctx)
if err == nil && crossSigningKeys != nil {
	masterKey = crossSigningKeys.MasterKey.String()
}

When the remote user confirmed first (txn.ReceivedTheirMAC == true), ConfirmSAS called:

vh.trustKeysAfterMACCheck(ctx, txn, masterKey)

In cross-user verification (txn.TheirUserID != vh.client.UserID), trustKeysAfterMACCheck compares theirSigningKeys.MasterKey with the passed masterKey. Since masterKey contained the local user's master key, verification failed with master keys do not match.

Solution

• Added TheirMasterKey field to VerificationTransaction to preserve the remote master key extracted in onVerificationMAC.
• Updated ConfirmSAS to pass txn.TheirMasterKey to trustKeysAfterMACCheck.
• Added unit test TestCrossSignVerification_SAS to verificationhelper_sas_test.go covering both confirmation orders (sendingConfirmsFirst = true/false).

Checklist

• I have read and followed the contributing guidelines at https://docs.mau.fi/bridges/general/contributing.html