Audit Fixes 1: XION Authentication fix and test

[Kayanski]

This Pr aims at adding Auth permissions fix for xion (found during the audit by us)

Changes :

• Account contract is now always whitelisted, it can execute on itself non-admin actions
• ownership::assert_nested_owner flag, now checks that the contract has admin execution rights in case of a XION Abstract Account
• Removed admin checks for xion in the whitelist function (not used anymore)
• Added a test to make sure it's not possible to bypass the admin check when calling from a module
• Added admin checks on the Auth Method admin methods (original audit issue)

Checklist

• CI is green.
• Changelog updated.

[cloudflare-workers-and-pages]

Deploying abstract-docs with    Cloudflare Pages

Latest commit:	53a1373
Status:	✅  Deploy successful!
Preview URL:	https://1d3cd94d.abstract-docs.pages.dev
Branch Preview URL:	https://fix-auth-permissions-xio.abstract-docs.pages.dev

View logs

[codecov]

Codecov Report

Attention: Patch coverage is 80.00000% with 9 lines in your changes missing coverage. Please review.

Please upload report for BASE (audit-fixes/root@a647229). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
framework/contracts/account/src/execution.rs	82.6%	4 Missing ⚠️
.../abstract-std/src/objects/ownership/gov_ownable.rs	81.2%	3 Missing ⚠️
framework/contracts/account/src/contract.rs	66.6%	2 Missing ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
framework/contracts/account/src/modules.rs	97.0% <ø> (ø)
...amework/contracts/account/src/modules/migration.rs	95.7% <ø> (ø)
framework/contracts/account/src/contract.rs	85.4% <66.6%> (ø)
.../abstract-std/src/objects/ownership/gov_ownable.rs	92.7% <81.2%> (ø)
framework/contracts/account/src/execution.rs	85.8% <82.6%> (ø)

[adairrr]

Should we return a more specific error such as NotAdmin?

[Kayanski]

Not really because this logic ensures that it's the owner calling the contract. If a module calls the account, then it's not the owner calling it. So I would stick with that