node+chains: stamp ChainSecurityProfile pin into C-Chain plugin config (closes F118)

Companion to coreth: c84950de4. The chain manager now forwards the
chain-wide ChainSecurityProfile resolved at node bootstrap (F102)
into the C-Chain (coreth) plugin Initialize payload by stamping a
profileID + profileHashHex pin into the JSON config bytes that
already cross the rpcchainvm boundary.

- chains/manager.go adds ManagerConfig.SecurityProfile and an
  injectSecurityProfileConfig pass (mirror of injectAutominingConfig)
  that runs only on EVMID and is a no-op when the profile is nil.

- node/node.go threads n.securityProfile into chains.ManagerConfig.

- version/constants.go patch-bumps to 1.26.12.

Four F118 tests in chains/security_profile_f118_test.go:
- StampsCChainOnly — pin appears in EVMID config, not in other VMs.
- NoOpWhenProfileNil — classical-compat path passes through.
- MergesExistingConfig — automining + skip-block-fee survive.
- RoundTripsAcrossPluginBoundary — the wire form decodes cleanly
  into the coreth-side LuxSecurityProfilePin struct shape, with the
  hash decoding to a full 48 bytes (SHA3-384 width).

go.mod bumps consensus v1.23.5 → v1.23.9 to pick up the F113
checkpoint+Merkle SHA3-384 widening.

version/constants.go

@@ -76,8 +76,8 @@ var (
 // These should match the latest git tag
 const (
 	defaultMajor = 1
-	defaultMinor = 23
-	defaultPatch = 25
+	defaultMinor = 26
+	defaultPatch = 12
 )
 
 func init() {