AddFileWithHash rejects hashes that are not multihashes (closes #129)

AddFileWithHash took any non-empty bytes as a hash, so the builder could
write a manifest that mfer refuses to load. It now decodes the hash with
go-multihash and also requires a digest of at least 32 bytes, the SHA-256
length the reader's decoding-cost limit assumes: a valid but shorter
multihash, such as an empty identity hash or SHA-1, still makes a
manifest of one-character paths too costly to load. Test fixtures that
used 34 zero bytes, which is not a valid multihash, now use a SHA-256
multihash.

Model: opus-5-5

mfer/builder_test.go

@@ -120,32 +120,6 @@ func TestBuilderAddFileWithHashRejectsBadHashes(t *testing.T) {
 	}
 }
 
-// Entries made from the shortest inputs AddFileWithHash accepts (a
-// one-character path, an empty file, a modification time at the epoch and
-// a SHA-256 multihash) are the most costly to decode for their size, and a
-// manifest of them still loads.
-func TestBuilderShortestEntriesLoad(t *testing.T) {
-	t.Parallel()
-
-	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
-	require.NoError(t, err)
-
-	const names = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-
-	b := NewBuilder()
-	for _, name := range strings.Split(names, "") {
-		err = b.AddFileWithHash(RelFilePath(name), 0, ModTime(time.Unix(0, 0)), hash)
-		require.NoError(t, err)
-	}
-
-	var buf bytes.Buffer
-	require.NoError(t, b.Build(context.Background(), &buf))
-
-	m, err := NewManifestFromReader(&buf)
-	require.NoError(t, err)
-	assert.Len(t, m.Files(), len(names))
-}
-
 func TestBuilderBuild(t *testing.T) {
 	t.Parallel()