test: fix `P2SH` script in coins cache fuzz target #35218

Problem

coinscache_sim manually constructs a 23-byte P2SH scriptPubKey, but placed OP_EQUAL at byte index 12. That index is inside the 20-byte script hash payload, so the constructed script did not match the standard P2SH layout: https://github.com/bitcoin/bitcoin/blob/fa2670bd4b5b199c417011942228ba87d1613030/src/script/script.cpp#L223-L230

Fix

Place OP_EQUAL after OP_HASH160, the 20-byte push opcode, and the 20-byte script hash. Also remove a stray trailing comment terminator in the same fuzz target.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35218.

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline for information on the review process.

If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

ACK ac58e6c53c262e08584cb809daf3fbc8dd4d3732

Can be tested with (instantly crashes on master):

diff --git a/src/test/fuzz/coinscache_sim.cpp b/src/test/fuzz/coinscache_sim.cpp
index 9d41a6c058..c0a0d4e4d2 100644
--- a/src/test/fuzz/coinscache_sim.cpp
+++ b/src/test/fuzz/coinscache_sim.cpp
@@ -71,6 +71,7 @@ struct PrecomputedData
                 coins[i].out.scriptPubKey[1] = 20;
                 std::copy(hash.begin(), hash.begin() + 20, coins[i].out.scriptPubKey.begin() + 2);
                 coins[i].out.scriptPubKey[12] = OP_EQUAL;
+                assert(coins[i].out.scriptPubKey.IsPayToScriptHash());
                 break;
             case 2: /* P2WPKH */
                 coins[i].out.scriptPubKey.resize(22);

crACK ac58e6c53c262e08584cb809daf3fbc8dd4d3732

ACK ac58e6c53c262e08584cb809daf3fbc8dd4d3732

For reference, this fixes #27011 first released in v25.0