feat: implement MEV protection and commit-reveal for subscription cha…

[wagmiiii]

Closes #430

Summary:
This PR introduces robust Miner Extractable Value (MEV) protection to the subscription contracts to safeguard
users against frontrunning and sandwich attacks when their subscriptions are charged. It implements a commit-reveal
scheme, gas bidding analysis, and allows for private mempool integration.

What Changed:

• Added ChargeCommitment and MevAttackDetected types to contracts/types/src/lib.rs.
• Created a commit_charge function that hashes and stores pending payload details in transient storage (TTL-
  based).
• Refactored charge_subscription into a backwards-compatible wrapper that delegates to reveal_charge.
• Implemented commitment verification and MEV logging inside reveal_charge for charges exceeding the
  LargeChargeThreshold.
• Updated contracts/subscription/THREAT_MODEL.md to formally document the MEV threat model.
• Added comprehensive unit tests in contracts/subscription/src/test.rs.

Key Design Decisions:

• Admin Configuration: The large charge threshold was made fully admin-configurable via
  set_large_charge_threshold so that it can adapt dynamically to network/market conditions.
• Private Mempool Enforcement: Note on Issue Mismatch: While the issue requested "Private mempool
  integration," Soroban smart contracts do not have native execution awareness of the transaction lifecycle's origin
  mempool. We accommodated this by enforcing that users commit to an is_private_mempool flag, which off-chain
  clients/SDKs must respect when routing the transaction.
• Transient Storage: We leveraged Soroban's temporary_set for the commit hash. This prevents storage bloat
  from orphaned commitments and avoids expensive ledger fees.

Acceptance Criteria Checklist:

• Commit-reveal scheme for large charges
• Slippage protection with max fee bounds (PriceBounds and Gas Bidding)
• Private mempool integration option
• MEV extraction monitoring
• Gas price analysis for attack detection
• Documentation of MEV threat model

Security Note:
The commit_charge payload utilizes env.crypto().sha256(). Temporary commitments are automatically wiped out
upon successful execution to prevent replay attacks, while sub.subscriber.require_auth() guarantees that no third
party can initiate the reveal on behalf of an unwilling subscriber.

[drips-wave]

@wagmiiii Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits