fix(rate-limiting): validate genesis state - #9021

IsAddressPairWhitelisted decided membership with len(value) != 0, but a
zero-value WhitelistedAddressPair marshals to zero bytes. Under the old
concatenated layout this was unreachable: AddressWhitelistKey("", "")
produced an empty key, which store.Set rejects. The new length-prefixed
layout makes it the valid one-byte key 0x00, so InitGenesis can now
store such a pair (GenesisState.Validate does not inspect
WhitelistedAddressPairs) and no reader can ever find it again. Decide
membership with store.Has instead.

GetAllRateLimits logged the failing entry's key as a string. Keys now
begin with a raw uvarint length byte, so the module's only diagnostic
for a corrupt rate limit rendered a control character. Log it as hex.

The changelog entry omitted the module consensus version bump, which is
the fact that tells an integrator their upgrade handler has to run
module migrations for the re-key to apply.

TestMigrate2to3's comment claimed the test proves Migrate2to3 reaches v3
through the keeper's own store service and codec, but the test
constructs both itself, so it cannot fail for that reason. Describe what
it does check.

CodeQL go/allocation-size-overflow (high) fired on both key builders:
the make() capacity was computed as 1+len(a)+len(b) directly from
caller-supplied string lengths, with no bound checked first.

Share one helper that checks each addition against math.MaxInt before
computing the capacity. The emitted bytes are unchanged; the layout
tests in keys_test.go pin that. Allocation stays exact at one alloc.

Refs https://github.com/cosmos/ibc-go/security/code-scanning/2176

The bounds-checked version cleared go/allocation-size-overflow but
introduced beginendblock-panic: BeginBlocker resets rate limits, so it
reaches these builders, and the module deliberately swallows every error
from that path to avoid failing block processing. A panic there defeats
that guarantee no matter how unreachable the condition is.

Growing the key by append removes both: no capacity expression for the
overflow rule to flag, and no panic on a consensus path. Emitted bytes
are unchanged; keys_test.go pins the layout.