fix(core): clone messages at mutation sites now aliasing under ref

Under ref semantics `var m = someMessage; m.field = ...` mutates the
shared instance the caller still holds. Fix the outbound mutation sites:

- waku_relay/protocol.nim publish: replace the local `var message` +
  timestamp patch with `wakuMessage.ensureTimestampSet()`
- rln/proof.nim attachRLNProof: clone before writing `.proof`
- rest_api relay attachRlnProofAndValidate: clone before writing `.proof`

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

logos_delivery/waku/rest_api/endpoint/relay/handlers.nim

@@ -69,7 +69,7 @@ proc attachRlnProofAndValidate(
   ## RlnValidatorErrorMsg), schedules a background merkle proof refresh and
   ## fails early with StaleProofSuspected — the caller decides whether to
   ## retry. Callers invoke only when RLN is mounted.
-  var msg = message
+  let msg = message.clone()
   msg.proof = (
     await rln.generateRLNProof(msg.toRLNSignal(), float64(getTime().toUnix()))
   ).valueOr:

logos_delivery/waku/rln/proof.nim

@@ -89,7 +89,7 @@ proc attachRLNProof*(
   ## Returns the message with a freshly generated RLN proof, replacing any
   ## existing one and drawing a new message id. Retry paths suspecting a stale
   ## path should call `invalidateMerkleProofCache` first.
-  var msgWithProof = message
+  let msgWithProof = message.clone()
   msgWithProof.proof = (
     await r.generateRLNProof(message.toRLNSignal(), float64(getTime().toUnix()))
   ).valueOr:

logos_delivery/waku/waku_relay/protocol.nim

@@ -689,9 +689,7 @@ proc publish*(
   if pubsubTopic.isEmptyOrWhitespace():
     return err(NoTopicSpecified)
 
-  var message = wakuMessage
-  if message.timestamp == 0:
-    message.timestamp = getNowInNanosecondTime()
+  let message = wakuMessage.ensureTimestampSet()
 
   let data = message.encode().buffer