Lightclient may use a missed block as best partial update

[twoeths]

Describe the bug

Lightclient uses a missed block as best partial update, for example

signedHeaderRoot: 0x43bed465664abeda7e58deeb1e2eff4234b837ed919245857e529330215d2277
signedHeaderSlot: 2775712

notice that the next slot (2775713) is missed so that should not be the best partial update

Expected behavior

It's likely that the block comes very late and it's not part of canonical chain (see #3925).

Should we only update best partial update only once the block is finalized? Or at least only update it only once the block becomes new head.

[twoeths]

Update: the above log is not an evident for the issue as root 2775712 could be attested by the next 2 slot, 2775714

but it could be potentially an issue: an imported block may not be part of the canonical chain after all

[dapplion]

That's a good point! The update could be computed only in response to a head change instead of importing a block.