feat: add MQTT message validation per arena-docs spec

[Copilot]

Arena-unity was missing all client-side MQTT message validation that arena-web-core already enforces. This adds the missing checks from the message-validation spec to ArenaClientScene.Messaging.cs.

Payload validation (Section 2)

• Drop empty/null payloads with warning
• Silently drop invalid JSON
• Warn and drop if object_id is missing
• Silently drop if object_id doesn't match topic UUID (position 6) — critical for security in concert with broker ACL

Message envelope validation (Section 3)

• Warn and drop missing or invalid action (valid: create, update, delete, clientEvent, leave)
• Warn and drop missing data for create/update actions
• Warn (continue) on missing type or missing object_type on creates

Self-message filtering (Section 4)

• Silently skip messages from own userClient (topic position 5) — prevents feedback loops
• Silently skip messages whose UUID (position 6) matches own camera/hand IDs

Security (Section 6)

• Block goto-url and textinput clientEvent types from remote clients
• Only process camera-override and rig messages if addressed to own camera (topic position 7 in localCameraIds)
• Warn and drop clientEvent where deprecated source field doesn't match topic toUid

Method signature changes

ProcessArenaMessage and ClientEventOnObject now accept an optional string[] topicSplit to carry topic context through the call chain without re-parsing.