test: add contract auth-enforcement tests without mocked auth

[Hollujay]

Summary

submit_attestation is the entire trust boundary of this project: only a
provider's registered operator may post for it. That guarantee should be pinned
by a test that proves require_auth() is genuinely enforced, not merely
present in the source.

A test running with all auths mocked cannot demonstrate this — it passes
whether or not the check is there.

Acceptance Criteria

• Add a test where a non-operator address attempts submit_attestation
  without mocking auth, and assert it fails
• Same for register_provider if it has an auth requirement
• Leave a comment in the test explaining why auth is deliberately not
  mocked here, so a future contributor doesn't "fix" it by adding mocks

Tech Stack

Rust, soroban-sdk test utilities