feat: Add whitelisting capability for approved addresses

[yusuftomilola]

Summary

Implements whitelisting capability in the Soroban session contract, fulfilling all acceptance criteria in the issue.

What's Changed

src/lib.rs

• DataKey::Admin and DataKey::Whitelist(Address) storage keys added
• initialize(admin) — one-time admin setup during deployment
• �dd_to_whitelist(address) — admin-only; emits AddedToWhitelist event

emove_from_whitelist(address) — admin-only; emits RemovedFromWhitelist event

• is_whitelisted(address) -> bool — public read
• create_session — enforces onlyWhitelisted guard; non-whitelisted callers panic with "caller is not whitelisted"

src/test.rs

• est_add_to_whitelist — verifies address is tracked after add
• est_remove_from_whitelist — verifies address is removed
• est_non_admin_cannot_add — non-admin call reverts
• est_whitelisted_user_can_create_session — whitelisted user can create a session
• est_non_whitelisted_user_cannot_create_session — non-whitelisted user is blocked
• est_revoke_session — session revocation still works
• est_whitelist_events_emitted — events published without panic

closes #27