fix: add Soroban auth secret nonce revocation method - #1185

Overview

This PR adds a Soroban Auth Secret Nonce Revocation mechanism that enables asset owner accounts to invalidate past off-chain signatures if a secret key is compromised before signatures expire. It implements a revoke_user_nonces function and enforces a minimum nonce threshold during authorization payload validation.

Related Issue

Changes

🔐 Nonce Revocation Method

• [ADD] contracts/access-control/src/lib.rs

  • Implements revoke_user_nonces(env: Env, min_nonce: u64) for asset owner accounts.
  • Stores the caller's minimum valid nonce in contract storage.
  • Emits a revocation event for off-chain monitoring.

• [MODIFY] contracts/access-control/src/lib.rs

  • Updates signed authorization payload validation to reject any payload with nonce < min_nonce.
  • Performs the nonce check before signature verification to short-circuit invalid authorizations.

• [ADD] contracts/access-control/src/test.rs

  • Adds unit tests covering nonce revocation, boundary nonce acceptance, and rejection of revoked nonces.
  • Verifies only the asset owner can call revoke_user_nonces.

Verification Results

cargo test --package access-control
✅ 16/16 passed

Live acceptance check:
✅ revoke_user_nonces updates min_nonce on owner account
✅ Signed payloads with nonce < min_nonce are rejected
✅ Signed payloads with nonce >= min_nonce are accepted
✅ Nonce revocation persists across contract calls

Closes #1175