fix merkle verify vulnerability

[eyusufatik]

The current merkle verification can be cheated when there is not-power-of-2 number of leaves on the merkle tree. The attack allows for using a different index than the original.

This is due to the duplication effect the Bitcoin merkle tree has.

            o
         /       \
       o.          o
     /   \.       /. \
    o.    o.     o 
  /  \.  / \.   / \ 
 a   b  c.  d. e.  f

For this tree, the parent of e and f is duplicated to calculate its parent when the merkle tree is built.

This allows for an attacker to use index 6 instead of 4. If an application depending on BTCUtils needs to compare ordering of bitcoin txs and only trust the SPV proof, this is problematic.

The proposed fix is to compare with the left child whenever current hash is the right child.

In the test vectors I added an example that has the same exact proof but uses index 2 and 3 for the same leaf. The output was true for both cases before the change in the Solidity code. I can add more tests if needed.