fix(contract): validate token addresses using contract-safe checks

[originaldefiboy]

Closes #468

---

Summary

• move token validation into a shared helper in the contract validation module
• replace the brittle XDR byte inspection with a safer contract-call-based validation path
• add regression coverage for both invalid and valid token-address flows

Related issue

• ## [CONTRACT-12] Implement validate_token_is_contract Using WASM-Safe XDR Inspection #468