feat: restrict dispute raising to invoice parties

[Buchi-Einstein]

Description

Restrict raise_dispute on both the invoice and treasury contracts so that only the invoice's merchant or payer (customer) can open a dispute. Previously any address could grief a settlement.

Changes

Invoice contract (COMEBACKHERE-contracts/contracts/invoice/src/lib.rs)

• Added NotAParty error variant to ContractError
• Modified raise_dispute to fetch the invoice record and verify claimant is either invoice.merchant or invoice.customer

Treasury contract (COMEBACKHERE-contracts/contracts/treasury/src/lib.rs)

• Added NotSettlementParty error variant to TreasuryError
• Modified raise_dispute to fetch the settlement record and verify signer is settlement.merchant

Tests

• Added tests for random address rejection, merchant success, and customer (payer) success on invoice contract
• Added tests for non-merchant rejection and merchant success on treasury contract
• Updated existing integration tests to use the merchant as the disputing party

Security

This is a security-sensitive change. Previously any address could call raise_dispute on any invoice/settlement, allowing griefing attacks that put legitimate settlements on hold. Now only the invoice parties (merchant/customer) can raise disputes.

Closes #177

[drips-wave]

@Buchi-Einstein Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits