test: TIP-1011 enhanced access key permissions coverage

[decofe]

Targets mutation test survivors from TIP-1011 (#3384). Adds 19 compact
unit tests covering branches that cargo-mutants flagged as unkilled:

• call_scope_allows_call: 10 tests exercising all 12 branches (None/empty scopes,
  create tx, target mismatch, selector match/mismatch, short input, recipient
  check, dirty ABI padding)
• validate_t3_key_authorization_restrictions: 5 tests for too-many selector
  rules, duplicate selectors, too-many recipients, zero-address recipient,
  non-constrained selector with recipients
• Pre-T3 gates: 2 tests for periodic limits and call scopes rejected before T3
• KeyAuthorization helpers: 2 tests for has_periodic_limits and
  has_call_scopes branch coverage

Co-Authored-By: grandizzy 38490174+grandizzy@users.noreply.github.com

Prompted by: georgen

[github-actions]

⚠️ Changelog not found.

A changelog entry is required before merging. We've generated a suggested changelog based on your changes:

Preview

---
tempo-primitives: patch
tempo-transaction-pool: patch
---

Added tests for `has_periodic_limits` and `has_call_scopes` helpers in key authorization, and exhaustive branch coverage for `call_scope_allows_call`, T3 key authorization restriction rejections, and pre-T3 gating of periodic limits and call scopes in the transaction pool validator.

Add changelog to commit this to your branch.