fix: restrict creation deposit release to the market creator

[CHEF-SAVY]

close #179

markets.rs — claim_creation_deposit:

• Added caller: Address parameter
• Added an explicit caller != market.creator check returning NotAuthorized before the auth call — this rejects third-party calls with a clear error rather than letting Soroban's auth framework handle it opaquely
• caller.require_auth() then enforces the creator actually signed the transaction

lib.rs — public entrypoint:

• Added caller: Address to the public function signature, making the authorization requirement visible at the API boundary

The old code had market.creator.require_auth() which technically worked in Soroban (the creator must have signed), but the function took no caller parameter — meaning anyone could invoke it and the auth check was implicit/
hidden. The new approach makes it explicit: the caller declares who they are, we verify it matches the creator, then require their signature.

[drips-wave]

@CHEF-SAVY Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits