fix(agglayer): replace NoAuth with NetworkAccount on bridge and faucet

[partylikeits1983]

Summary

Closes #2797.

Installs the NetworkAccount auth component (added in #2817) on both the AggLayer bridge and the AggLayer faucet, with per-account whitelists of input-note script roots. This closes the forged-MINT attack surface: an attacker can no longer finalize an arbitrary transaction against the bridge and emit a bridge-authored MINT note.

Whitelists

• Bridge: CLAIM, B2AGG, CONFIG_AGG_BRIDGE, UPDATE_GER
• Faucet: MINT, BURN

Changes

• crates/miden-agglayer/src/lib.rs — swap NoAuth for NetworkAccount in create_bridge_account, create_existing_bridge_account, create_agglayer_faucet, create_existing_agglayer_faucet. New helpers bridge_note_whitelist() / faucet_note_whitelist() and a claim_script_root() accessor mirroring the other note wrappers.
• crates/miden-agglayer/build.rs — compute BRIDGE_CODE_COMMITMENT and FAUCET_CODE_COMMITMENT using NetworkAccount. Whitelist contents do not affect the commitment, so an empty whitelist suffices here.
• crates/miden-testing/tests/agglayer/network_account_regression.rs — two regression tests that replay the NoAuth on the bridge account lets anyone emit bridge-authored MINT notes #2797 attack paths against a bridge account built with the production create_existing_bridge_account helper:
  1. bridge_rejects_tx_script_after_2797_fix — any tx with a tx script is rejected with ERR_NETWORK_ACCOUNT_TX_SCRIPT_NOT_ALLOWED.
  2. bridge_rejects_non_whitelisted_input_note_after_2797_fix — any tx consuming a non-whitelisted note is rejected with ERR_NETWORK_ACCOUNT_NOTE_NOT_WHITELISTED.

Stacking

This PR is the final one in the #2797 fix chain:

• feat(kernel): expose tx script root via public kernel procedure #2816 — tx::get_script_root kernel procedure
• feat(standards): add NetworkAccount auth component #2817 — NetworkAccount auth component
• this PR — AggLayer wire-up

Stacked on top of ajl-network-account-component; rebase onto next once the parents merge.

[mmagician]

Note: this and the supporting PR(s) should be cherry-picked into the agglayer branch after they land on next (or vice-versa) to make a follow-up to the audit simpler.

[PhilippGackstatter]

I think this PR is a requirement before we can remove AccountStorageMode::Network (#2285). All standard network accounts we define (bridge + agglayer faucet, network fungible faucet) need to start using AuthNetworkAccount, so that we can identify them as network accounts via the NetworkAccountNoteAllowlist storage slot rather than the storage mode.

My understanding is this PR deals with the bridge and agglayer faucet, so the next step after this PR is to migrate the network fungible faucet (as created by create_network_fungible_faucet) and then remove the storage mode.