feat: harden caller authorization and precondition guards in admin_tax_withholding_deductions (closes #335)

[esthertitilayo-dev]

Summary

Hardens �dmin_tax_withholding_deductions (closes #335).

Problem

1. 
   equire_admin\ was called after the \TaxWithholdingExecutionLock\ was written to instance storage. An unauthorized caller could cause a storage entry to appear on the ledger even though the call was ultimately rejected.
2. Input/state validation (\milestone_index >= count, \milestone.amount <= 0, \ ax_rate_bps > 10_000, \contract_balance <= 0) was performed inside a closure after the lock was already written.
3. \10_000\ was used instead of the named constant \BPS_SCALE.

Fix

Moved
equire_admin\ to the first statement — before any storage read. Moved every input/state guard outside the closure and before the lock write. All five rejected paths now return with zero storage entries mutated. Replaced the hard-coded literal with \BPS_SCALE. Added a dedicated test file (\�dmin_tax_withholding_guards_tests.rs) covering: uninitialized contract, non-admin caller, unfunded escrow, out-of-range milestone, rate above scale, zero balance, and the success path with event assertion.

Notes

This PR is orthogonal to #347 and #349 and does not depend on either.

---

Before merging: verify that CI passes all \cargo test\ and \clippy\ checks on this branch.

[drips-wave]

@esthertitilayo-dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits