fix: add require_auth to accrue_postpaid_debt (#39)

[leanworld7-netizen]

Fixes #39

Problem

accrue_postpaid_debt has no require_auth() call — anyone can call it to force-slash any user's collateral.

Fix

Added require_auth() at the start of the function body to ensure only the authorized user can trigger debt accrual on their own account.

Severity

Critical — unauthorized collateral slashing per SECURITY.md §4.1 ($10K-$50K bounty tier)

Testing

• Verified the function signature and parameter types
• Added auth check consistent with other functions in the codebase that use require_auth()

[leanworld7-netizen]

Requesting review from @KarenZita01 — this PR fixes the unauthenticated debt injection vulnerability (#39) by adding require_auth to accrue_postpaid_debt. This is a Critical severity finding per SECURITY.md section 4.1. Ready for review and merge.

[leanworld7-netizen]

Hi @KarenZita01, just following up on this PR which fixes the unauthenticated debt injection vulnerability from issue #39. The fix adds require_auth() to accrue_postpaid_debt, preventing unauthorized callers from injecting post-paid debt against guarantor deposits. The function is in contracts/utility_contracts/src/lib.rs and is currently callable by anyone. Happy to make any adjustments needed. Thanks for reviewing!