Add contract security review checklist

[El-swaggerito]

Description

Difficulty: Expert

Type: Security

Summary

Add a security review checklist for PocketPay contract changes.

Current Behaviour

Contributors may change contract logic without consistently reviewing authorisation, state invariants, boundary values, and failure behaviour.

Expected Behaviour

The repo should provide a contract-specific security checklist for reviewers and contributors.

Suggested Implementation

Create checklist docs and link from PR template and README.

Files or Areas Likely Affected

• docs/
• README.md
• .github/
• contracts/
• tests/

Acceptance Criteria

• Security review checklist is added.
• Authorisation checks are included.
• State invariant checks are included.
• Boundary value checks are included.
• Failure-path checks are included.
• README links to checklist.

Additional Notes

This raises the standard for contract PRs.