Setup permissionless lanes for AssetHubs - heads/state-roots store

[bkontur]

Relates to: #6675
Relates to: #6116

This PR introduces the pallet-bridge-proof-root-store and deploys it on the AssetHubs. This pallet stores arbitrary key-value data and can be invoked via XCM Transact (e.g., para_id/HeadData along with a state_root sent from BridgeHubs).

It is used to store synced AssetHubRococo/Westend headers with their state_root on the opposite AssetHubWestend/Rococo. The headers are synced (syncing implementation: #8326) from BridgeHubWestend, and the stored state_roots are used to verify AssetHubRococo message proofs on AssetHubWestend (and vice versa).

Note1: Without this new pallet, we could potentially still use pallet-bridge-parachains, but it's somewhat heavy due to its three storage items (ParasInfo, ImportedParaHeads, and ImportedParaHashes). Replicating all that data doesn’t make much sense. If we go that route, we might as well add pallet-bridge-grandpa and full finality to AssetHub - which we don’t want.

Note 2: This pallet will most likely remain on AssetHub regardless of the syncing mechanism (XCM, multiple proofs, RC-based proofs, etc.). See more reasoning here: #8326.

Usage

Pallet configuration on the AH: (stores synced parachain finality mapping: bridged block hash vs state root)

/// AssetHubWestendProofRootStore:
impl pallet_bridge_proof_root_store::Config<AssetHubWestendProofRootStoreInstance> for Runtime {
	...
	// Means `block_hash` of AHW.
	type Key = HashOf<
		pallet_bridge_messages::BridgedChainOf<Runtime, WithAssetHubWestendMessagesInstance>,
	>;
	// Means `state_root` of AHW.
	type Value = HashOf<
		pallet_bridge_messages::BridgedChainOf<Runtime, WithAssetHubWestendMessagesInstance>,
	>;
	...
}

The pallet is used for AssetHubWestendHeaders as a bp_header_chain::HeaderChain implementation for pallet-bridge-messages:

impl pallet_bridge_messages::Config<WithAssetHubWestendMessagesInstance> for Runtime {
	type ThisChain = bp_asset_hub_rococo::AssetHubRococo;
	type BridgedChain = bp_asset_hub_westend::AssetHubWestend;
	type BridgedHeaderChain = AssetHubWestendHeaders;

// Adapter `bp_header_chain::HeaderChain` implementation which resolves AssetHubWestend
/// `state_root` for `block_hash`.
pub struct AssetHubWestendHeaders;
impl bp_header_chain::HeaderChain<pallet_bridge_messages::BridgedChainOf<Runtime, WithAssetHubWestendMessagesInstance>> for AssetHubWestendHeaders {
	fn finalized_header_state_root(
		header_hash: HashOf<
			pallet_bridge_messages::BridgedChainOf<Runtime, WithAssetHubWestendMessagesInstance>,
		>,
	) -> Option<
		HashOf<
			pallet_bridge_messages::BridgedChainOf<Runtime, WithAssetHubWestendMessagesInstance>,
		>,
	> {
		AssetHubWestendProofRootStore::get_root(&header_hash)
	}
}	

Syncing hash/state root from the local BridgeHub: This is a simple solution using XCM, implemented here: #8326. An unpaid XCM Transact call is used to invoke AssetHubWestendProofRootStore::note_new_roots(...), where roots is a list of tuples (block_hash, state_root) representing the bridged AssetHub blocks.

	#[pallet::call_index(0)]
	pub fn note_new_roots(
		origin: OriginFor<T>,
		roots: BoundedVec<(T::Key, T::Value), T::RootsToKeep>,
	) -> DispatchResult {

High-Level Context Diagram

[bkontur]

/cmd fmt

[serban300]

Left just one comment so far. Didn't look on all the code and especially on the tests. At the moment it's not clear to me how these proofs are checked.

I will look on #8326 and get back to this PR after

[bkontur]

At the moment it's not clear to me how these proofs are checked.

I will look on #8326 and get back to this PR after

@serban300 I've updated the description with more details, diagram and usage information. Please check the attached diagram for more context.

The proofs (FromBridgedChainMessagesProof / FromBridgedChainMessagesDeliveryProof) are verified as before using pallet-bridge-message - there is no change in that regard.
The only difference compared to the actual BridgeHub is the implementation of the HeaderChain trait, which provides the state_root (BH reads it directly from pallet-bridge-parachains but AH needs to "read" it from some synced "storage").

Basically, we're doing all of this to propagate the state_root of the bridged AssetHub.
For more details and reasoning, please see the description here: #8326.

[paritytech-workflow-stopper]

All GitHub workflows were cancelled due to failure one of the required jobs.
Failed workflow url: https://github.com/paritytech/polkadot-sdk/actions/runs/16429703900
Failed job name: test-linux-stable-no-try-runtime