fix(controlplane): enforce project-scoped RBAC on AttestationService/GetContract
A project-scoped API token could call AttestationService/GetContract with another project's name and receive that project's workflow metadata and full contract schema. Attestation endpoints are authenticated through the attestation JWT path and skipped by the authz middleware, so the handler is the only authorization point, and GetContract was the lone attestation handler that never checked the caller's rights on the requested project.
This adds the same project authorization the sibling Init, Store and Cancel handlers already perform, applied after the workflow is resolved so the project reference is validated first. A project-scoped token now only sees workflows and contracts in its own project, while org-scoped tokens, workflow-scoped tokens, user, legacy robot account and federated callers keep their existing behavior.
To let the service-layer integration tests reproduce the context the attestation middlewares produce, usercontext.WithRobotAccount is exported alongside the existing CurrentRobotAccount reader.
Fixes PFM-6717
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri