feat: repeated/missing Soroban auth detection + BitmaskApprovalTracker

[fadee26]

Summary

closes #860 — Repeated Soroban authorization checks
Scope: packages/analyzers/soroban/dataflow/, packages/rules/soroban/src/authorization/

• repeated-auth-check-analyzer.ts tracks require_auth / require_auth_for_args / authenticate sites
• Groups by function + subject + execution path id (branch depth)
• Emits findings with consolidation suggestions
• Tests: repeated detection, single-check no-op, path metrics, class API

closes #859 — Missing Soroban authorization checks
Scope: packages/rules/soroban/src/authorization/, packages/analyzers/soroban/security/

• Identifies sensitive mutators (name heuristics + storage writes)
• Requires require_auth / require_auth_for_args / authenticate
• Excludes get_/view_/query_ and attribute-marked public entrypoints
• Reports line + function location
• Tests: transfer without auth, transfer with auth, public getters, pause mutator

Closes #752 — Bitmask multi-signature approval tracker (Yul)
Scope: contracts/access/BitmaskApprovalTracker.sol, test/access/BitmaskApprovalTracker.test.ts

• Single bytes32 slot for owner indices 0–255
• Yul AND / OR / XOR / shl for check, set, clear, toggle
• Batch set, quorum helper, admin-gated mutations
• Tests: packing, toggle, batch, clear, quorum, access control, multi-approval smoke

How to verify

# Analyzer unit tests (Jest / package runner as configured)
pnpm test --filter @gasguard/analyzers -- repeated-auth
pnpm test --filter @gasguard/rules -- authorization-rules

# Bitmask contract
npx hardhat test test/access/BitmaskApprovalTracker.test.ts

[drips-wave]

@fadee26 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits