fix(zksnark): harden sapling param extraction

[waynercheung]

Summary

Harden how the packaged Sapling parameters (sapling-spend.params and sapling-output.params) are extracted from the classpath during node startup.

Motivation

Sapling initialization requires the packaged parameters to be available as local files. The extraction process should use secure temporary-file handling, restrictive permissions where supported, explicit resource validation, and reliable cleanup.

Changes

• Create parameter files with Files.createTempFile(...).
• Apply owner-only permissions on POSIX file systems.
• Use NOFOLLOW_LINKS when writing extracted parameters.
• Retain platform-compatible behavior on non-POSIX file systems.
• Report missing classpath resources with an explicit TronError.
• Remove partial files when extraction fails.
• Retain deleteOnExit() for successfully extracted files.
• Add regression tests for the extraction lifecycle.

Successful Sapling initialization behavior remains unchanged. This PR does not modify the packaged parameters or their expected hashes.

Testing

• ./gradlew :framework:test --tests org.tron.core.zen.ZksnarkInitServiceTest
• ./gradlew :framework:test --tests org.tron.core.exception.TronErrorTest
• ./gradlew :framework:test --tests org.tron.core.zksnark.LibrustzcashTest.testLibsodium
• ./gradlew :framework:checkstyleMain :framework:checkstyleTest

Impact

• No API or configuration changes.
• No protocol or consensus changes.
• No changes to Sapling parameter contents or hashes.