Strip control characters from auth entry prompt

[fnando]

What

Sanitize the attacker-influenced strings rendered by format_auth_entry in log/auth.rs. The function name (Fn:), each contract-function argument (Args:), and the CreateContractV2 constructor arguments are now passed through soroban_spec_tools::sanitize before display, so terminal-escape and other control bytes are escaped rather than emitted verbatim.

Why

Auth entries shown in the interactive signing prompt come from the RPC's simulateTransaction response. A top-level ScVal::Symbol argument and the function name were printed raw, so control characters (e.g. ANSI escapes) reached the terminal unescaped and could distort what the user sees before approving a signature. The rest of the codebase already sanitizes attacker-influenced output at the display site — log/event.rs, commands/events.rs, and arg_parsing.rs — so this brings the auth prompt in line with that convention. Because the escaping lives inside format_auth_entry, it covers all of its call sites at once (the prompt, --auto-sign, and both invalid-entry error messages). A regression test mirrors the existing log/event.rs test, asserting no control characters survive.

Known limitations

Sanitization is applied at the display site rather than at the boundary in soroban_spec_tools::to_string. Boundary-level hardening (sanitizing the top-level ScVal::Symbol arm, capping the rendered argument count, and resetting terminal state before the decision line) is left as possible follow-up defence in depth.

[Copilot]

Pull request overview

Sanitizes attacker-influenced auth-entry output before terminal display.

Changes:

• Sanitizes function names, invocation arguments, and constructor arguments.
• Adds a control-character regression test.