filecoin-message-confirmer should verify the response message CID

[olizilla]

The StateSearchMsg method is suprising. If the message you ask for was replaced then it will return the replacing message rather than the specific message for the CID provided.

	// NOTE: If a replacing message is found on chain, this method will return
	// a MsgLookup for the replacing message - the MsgLookup.Message will be a different
	// CID than the one provided in the 'cid' param, MsgLookup.Receipt will contain the
	// result of the execution of the replacing message.
	//
	// If the caller wants to ensure that exactly the requested message was executed,
	// they must check that MsgLookup.Message is equal to the provided 'cid', or set the
	// `allowReplaced` parameter to false. Without this check, and with `allowReplaced`
	// set to true, both the requested and original message may appear as
	// successfully executed on-chain, which may look like a double-spend.

https://github.com/filecoin-project/lotus/blob/2e6369012517972eb3f4f24f8a28e5a834cc66ad/api/api_full.go#L435-L451

The caller should be able set a allowReplaced parameter to make it clear when they want to confirm the exact message for the CID provided.

[olizilla]

While whomever takes this on is in there, this comment is need fix

modules/packages/filecoin-message-confirmer/src/index.ts

Lines 15 to 16 in 9b97f31

	// 75 seconds is the default timeout, so we always capture 2 blocks regardless of when it happened (credit to Riba from PL)
	const defaultTimeout = 90000

unless defaultTimout uses a particularly weird unit.