Reentrancy protection on swaps

[naddison36]

Summary

Adds reentrancy protection around ARM liquidity-moving entrypoints to prevent nested swap callbacks from reusing the same pre-payout liquidity balance during buy-side swaps.

Changes

• Inherits ReentrancyGuardUpgradeable in AbstractARM.
• Initializes the guard during ARM initialization.
• Applies nonReentrant to:
  • both swapExactTokensForTokens entrypoints
  • both swapTokensForExactTokens entrypoints
  • collectFees
• Adds a focused regression test using a callback-capable mock base token that attempts to reenter a buy-side swap during transferFrom.

Verification

• forge test --match-path test/unit/OriginARM/Reentrancy.sol
• forge test --match-path 'test/unit/OriginARM/*.sol'

Notes

forge build --sizes shows OriginARM remains under the EIP-170 limit, but LidoARM and EtherFiARM exceed it, so this fix may need a smaller mitigation before merging for all ARM implementations.