fix: add security verification to install.sh (issue #2033)

[Dlove123]

Summary

Fixes security vulnerabilities in install.sh identified in issue #2033:

Security Fixes

1. TLS Certificate Verification Enforced ✅

   • Removed --insecure flag from curl commands
   • Removed --no-check-certificate flag from wget commands
   • All downloads now verify TLS certificates by default

2. SHA256 Checksum Verification ✅

   • Added verify_checksum() function
   • Optional MINER_CHECKSUM and FINGERPRINT_CHECKSUM environment variables
   • Verifies integrity of downloaded files before execution

3. GPG Signature Verification ✅

   • Added verify_signature() function
   • Optional SIGNATURE_URL and GPG_KEY_ID environment variables
   • Enhanced security through cryptographic signature verification

Changes

• Version bumped to 1.0.1
• Added security documentation header
• Added helper functions for checksum and signature verification
• Modified download section to enforce TLS and verify integrity

Testing

• Downloaded scripts are verified before execution
• Falls back gracefully if checksums not provided (warning only)
• GPG verification only runs if configured

Security Impact

• Before: Remote code executed without verification, vulnerable to MITM attacks
• After: All downloads verified via TLS + optional checksum/signature verification

---

💰 Payment Information

PayPal: 979749654@qq.com
ETH (Ethereum): 0x31e323edC293B940695ff04aD1AFdb56d473351D
GitHub: Dlove123

---

Fixes #2033

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Your PR has a BCOS-L1 or BCOS-L2 label
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!