fix(jwk): preserve certification on duplicate observations

[ByteYue]

Summary

• treat an observation matching the active InProgress or Finished proposal as an idempotent no-op
• reject quorum-certified updates that do not match the currently active proposal
• extend the JWK manager state-transition test across regular JWK observations and nonce-backed Gravity observations

Root cause

Observers periodically replay cached results. The manager previously compared each result only with on-chain state, then unconditionally replaced its local consensus state. Replaying an identical proposal could therefore drop the existing reliable-broadcast guard while certification was in progress, or drop the validator-transaction guard after certification and remove the transaction from the pool. A quorum certificate from a replaced session could also finish the newer session because it was not bound to the active proposal.

Compatibility

This is a local JWK manager state-machine fix. It does not change serialized types, validator messages, on-chain storage, quorum thresholds, or execution payloads. Different observations can still replace an in-progress proposal; only exact proposal replays are suppressed.

Testing

• cargo test -p aptos-jwk-consensus
• cargo test -p aptos-jwk-consensus jwk_manager::tests::test_jwk_manager_state_transition -- --exact
• git diff --check

Closes Galxe/gravity-audit#910