validate pubkey from extended public key when parsed; validate extended key version

[scgbckbone]

No description provided.

[scgbckbone]

fixed here:

• we allow to de-serialize extended public key that contains private key and vice-versa (we haven't checked the version vs data inside)
• we allow to de-serialize extended public that contains invalid secp256k1 pubkey, for example 020000000000000000000000000000000000000000000000000000000000000007 (not a security issue here as invalid pubkey would raise exception when we start working with it, but this imo should be part of validation logic)