Don't hash on deserialization.

For both blobs and certificate values:

• Serialize and Deserialize are only implemented for the non-hashed versions.
• There are explicit conversion functions:
  • with_hash computes the hash, converting the non-hashed to the hashed type.
  • with_hash_unchecked adds a given hash, without computing it, converting the non-hashed to the hashed type.
  • forget_hash converts the hashed to the non-hashed type.
• At public boundaries, i.e. any communication between the client and a node (server or proxy), the non-hashed version is sent, and the hash is computed on deserialization.
• In storage, the hash is stored separately (usually as the key), and after deserialization it is added using with_hash_unchecked.

In some cases hashed certificate values are part of things that get sent over the wire, e.g. Certificate. Here we should send a LiteCertificate and the CertificateValue separately. We should do the same thing for Vote.

In gRPC messages, CertificateValues and Blobs should be sent as BCS-serialized bytes, so that its hash can be computed without re-serializing it.

Start by tracing Serialize and Deserialize implementations for Blob and certificate values, then follow Certificate, Vote, storage boundaries, and gRPC messages across client-node communication. Done means wire formats use non-hashed values or BCS bytes, while stored hashes are restored separately without hashing during deserialization; the issue names no specific files or tests.