fix(rpc): inspect first raw tx positional arg for replay protection

[huklaa]

Fixes #381

Summary

Replay protection previously inspected only the parameter array shape for raw-transaction RPC methods, which allowed requests with additional positional parameters to bypass the intended raw transaction check.

This change makes the middleware consistently inspect the first positional argument as the raw transaction payload while preserving support for valid RPC requests that include additional parameters.

Changes

• inspect the first positional parameter for replay-protected raw transaction methods
• preserve requests containing valid additional positional parameters
• add regression coverage for the bypass case
• keep the change scoped to the RPC replay-protection middleware

Testing

Added focused regression tests covering the extra-parameter case and the existing expected behavior.

Scope

The fix is intentionally limited to the replay-protection issue described in #381. A final duplicate/WIP check found no competing PR addressing the same behavior.