fix: httpsig key order

[speeddragon]

Summary

Preserve the original committed-key order when converting messages to and from httpsig@1.0.

HTTPSig previously derived its encoded component list from maps:keys/1, which does not retain the
order of the source commitment. This could invalidate commitments originating from another codec,
particularly signed L1 transactions where field and tag order is significant.

Changes

• Order HTTPSig components according to their corresponding keys in the original committed list.
• Account for transport-derived components such as content-digest, ao-body-key, escaped keys, and +link keys.
• Add a regression test using a signed L1 transaction and the following conversion path: tx@1.0 → structured@1.0 → httpsig@1.0 → structured@1.0.
• Verify that the committed-key order and original transaction commitment survive the round trip.

Example

5Srj7HjQN4NNzK9BLxAOUNDCodmXhQzb6lWLIFD7D5E fails to verify because committed field order is different from when the message was signed.

(without order)

committed => List [4] {
    1 => data
    2 => content-type
    3 => device
    4 => status
}

vs

(with order)

committed => List [4] {
    1 => data
    2 => device
    3 => content-type
    4 => status
}