fix: wasmd and wasmvm security vulnerability

[fragwuerdig]

Summary

Moves the CosmWasm security fix from the private pre-release tags to the public releases.

• wasmd v0.61.8 (replaced by private v0.61.15-rc.2) → v0.61.15
• wasmvm v3.0.8-rc.2 (private) → v3.0.8 (cosmwasm 3.0.10, Wasmer 7.4.2)
• Removes the replace directives for the private security forks; the build no longer needs private repo access
• Only go.mod / go.sum change; no other module in the resolved dependency graph moves

Background

• The Wasmer bug allowed permissionless minting of native tokens and permanent loss of funds through a malicious contract
• It was already patched on the network by v4.0.1-patch.3 (private rc.2 tags)

Consensus safety

• Rolling upgrade: no governance proposal, no coordinated halt
• wasmd and wasmvm Go sources are identical between rc.2 and the public tags
• Only runtime change: Wasmer 7.4.0 → 7.4.2, which only changes how native stack-unwind frames are registered
  • Fixes a crash at startup on statically linked musl builds
  • Contract execution and gas metering are untouched → same app hash as rc.2 nodes

Operator notes

• Expect extra CPU use after the first restart: the Wasmer bump changes the module cache version, so contracts are recompiled as they are first used