test: cover marketplace token reentrancy

[dangelo352]

Summary

• Add a malicious payment-token mock that re-enters marketplace transfer paths
• Cover guarded reentry during buy_nft, accept_offer, competing place_bid with previous-bid refund, and end_auction settlement
• Assert the malicious token observed a nested guarded rejection and the marketplace reentrancy guard resets after the outer flow
• Update SECURITY_CHECKLIST.md with the tested scenarios and note that current offer cancellation has no token refund transfer

Closes #479.

Tests

• CARGO_TARGET_DIR=/tmp/commitlabs-market-reentry-target cargo test -p commitment-marketplace reentrant_payment_token -- --nocapture
• CARGO_TARGET_DIR=/tmp/commitlabs-market-reentry-target cargo test -p commitment-marketplace reentrancy -- --nocapture
• git diff --check

Note: the generated Soroban client exposes the nested guard rejection inside the mock token as an outer contract-call error; existing explicit guard tests in the same filter continue to assert MarketplaceError::ReentrancyDetected (#20) directly.