refactor: Switch HTTP outcalls receipts to hold spent cycles instead of refunds

[eichhorl]

As part of the new pay-as-you-go pricing for HTTP outcalls, each replica participating in the outcall reports its own cycles usage. This usage is reported as part of the response shares gossiped between peers of a subnet.

Before this PR, each node gossiped a refund share, describing the amount of cycles (out of the per-replica allowance), that the node would like to refund to the caller.

The problem with this approach is that on free subnets, the per-replica allowance is zero, in order to avoid minting cycles by mistake. This means that nodes on free subnets cannot properly report their (nominal) cycles usage, which is relevant for properly updating canister metrics.

Therefore, with this PR, nodes will instead report the amount of spent cycles (out of the per-replica allowance). In a follow up we can then allow nodes on free subnets to spend more cycles than their allowance of zero.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 917e2f1.

Security Overview

• 🔎 Scanned files: 13 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f5e9d2bb-29a4-4b64-902a-391d65fd8b2d?scanId=814f4d5f-a97c-4298-8567-74ea654815fe&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► rs/https_outcalls/consensus/benches/payload_validation.rs     /// Builds a node's contribution to an aggregated proof: a default (zero refund) payment receipt together with that node's signature over the corresponding receipt share.
Enhancement	► rs/https_outcalls/consensus/src/payload_builder.rs     /// Enforce the per-replica allowance on every receipt in the proof.
Enhancement	► rs/https_outcalls/consensus/src/payload_builder.rs     /// Enforce per-replica allowance for divergence shares.
Enhancement	► rs/https_outcalls/consensus/src/payload_builder/tests.rs     fn validate_payload_fails_for_spent_exceeding_allowance_non_replicated() { … } ► rs/https_outcalls/consensus/src/payload_builder/tests.rs     fn validate_payload_fails_for_spent_exceeding_allowance_fully_replicated() { … } ► rs/https_outcalls/consensus/src/payload_builder/tests.rs     fn validate_payload_fails_for_spent_exceeding_allowance_divergence() { … } ► rs/https_outcalls/consensus/src/payload_builder/tests.rs     fn validate_payload_fails_for_spent_exceeding_allowance_flexible_response() { … } ► rs/https_outcalls/consensus/src/payload_builder/tests.rs     fn validate_payload_fails_for_spent_exceeding_allowance_too_many_rejects() { … } ► rs/https_outcalls/consensus/src/payload_builder/tests.rs     fn validate_payload_fails_for_spent_exceeding_allowance_responses_too_large() { … } ► rs/https_outcalls/consensus/src/payload_builder/tests.rs     fn add_signer_with_excess_spent_to_proof(…);
Refactor	► rs/https_outcalls/consensus/src/payload_builder/utils.rs     pub(crate) fn check_spent_allowance(…);
Refactor	► rs/interfaces/src/canister_http.rs     /// A payment receipt claims the replica spent more than the per-replica allowance SpentExceedsAllowance { spent: Cycles, per_replica_allowance: Cycles },
Refactor	► rs/protobuf/def/types/v1/canister_http.proto     message CanisterHttpPaymentReceipt { spent = 1; }
Refactor	► rs/protobuf/src/gen/types/types.v1.rs     pub spent: ::core::option::Optionsuper::super::state::queues::v1::Cycles,
Refactor	► rs/types/types/src/batch/canister_http.rs     pub fn from(receipt: CanisterHttpPaymentReceipt) -> Self { refund -> spent }
Refactor	► rs/types/types/src/canister_http.rs     pub spent: Cycles,
Refactor	► rs/types/types/src/crypto/hash/tests.rs     usage updated to reflect spent instead of refund in tests