fix: remove tx source from auth entry signing logic

[mootz12]

What

Removes the tx source signer from the sign_soroban_authorizations function.

Why

The tx source account does not need to explicitly sign authorization entries. Signing the transaction is enough to authorize these entries.

Known limitations

None

[Copilot]

Pull request overview

This PR updates Soroban auth-entry signing so the transaction source account is no longer used as an explicit signer for sign_soroban_authorizations, based on the premise that the tx signature alone authorizes source-account auth entries.

Changes:

• Removes the source_signer parameter/plumbing from Soroban auth-entry signing.
• Refactors sign_soroban_authorizations to operate directly on the single InvokeHostFunction operation and rebuild the transaction only when needed.
• Updates an integration test to exercise invoking auth with a non-source identity.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
cmd/soroban-cli/src/signer/mod.rs	Refactors auth signing and removes tx-source signer fallback.
cmd/soroban-cli/src/config/mod.rs	Stops resolving/passing the tx source signer into auth signing.
cmd/soroban-cli/src/assembled.rs	Removes now-unused requires_auth helper/method.
cmd/crates/soroban-test/tests/it/integration/hello_world.rs	Adds coverage for auth invocation where the authorized address differs from --source.

Comments suppressed due to low confidence (1)

cmd/soroban-cli/src/signer/mod.rs:127

• After removing the source_signer fallback, an auth entry whose address equals the transaction source account will now hit MissingSignerForAddress unless the caller also included the source in signers. This contradicts the PR intent (“tx source doesn’t need to explicitly sign auth entries”) and will break contracts that require_auth() on the invoker/source without passing an address argument (so no signer is resolved). Consider detecting when the auth address equals raw.source_account and, in that case, leaving the entry untouched (and not requiring a signer).

        match signer {
            Some(signer) => {
                let signed_entry = sign_soroban_authorization_entry(
                    raw_auth,
                    signer,
                    signature_expiration_ledger,
                    &network_id,
                )?;
                signed_auths.push(signed_entry);
            }
            None => {
                return Err(Error::MissingSignerForAddress {
                    address: stellar_strkey::Strkey::PublicKeyEd25519(
                        stellar_strkey::ed25519::PublicKey(*needle),
                    )
                    .to_string(),
                });
            }