feat: implement per-user configurable cooloff period for stream creation

[muhsar27]

Closes #956
Here's a summary of all changes implemented for the per-user cooloff feature:
Changes
New file

• src/cooloff.rs (428 lines) — The per-user cooloff module implementing:
• CooloffDuration singleton + CooloffUntil(sender) per-sender storage
• get_cooloff_duration() / set_cooloff_duration() — admin-configurable duration
• get_cooloff_until(sender) — query remaining cooloff
• check_and_update_cooloff(sender) — guard called by create_stream/create_draft_stream
• 10 unit tests covering defaults, set/get, disable, blocking, expiry, extension, per-sender isolation, and TTL
  Modified files
• src/error.rs — Added CooloffActive = 22 variant
• src/events.rs — Added cooloff_duration_set event; fixed paused_at → pause_time variable name bug
• src/lib.rs — Integrated cooloff module: 3 new entrypoints + check_and_update_cooloff guard in create_stream and create_draft_stream; also fixed 6 pre-existing bugs (duplicate DataKey, symbol_short! length, function name length, release::withdrawable/vested_amount Result handling)
• src/storage.rs — Added WithdrawerAllowlist(u64) to DataKey + 4 new functions: add_withdrawer, remove_withdrawer, is_withdrawer_allowed, get_withdrawer_allowlist
• src/multi.rs — Fixed Vec::get() index types (u64 → u32) for Soroban SDK v23 API
• src/multi/tests.rs — Fixed (u64, ..) → (u64, _) syntax
• src/test.rs — Added 8 integration tests for cooloff through public entrypoints; fixed unclosed function in tests
• src/err_stab.rs — Added error discriminant stability test for errors 19–22
• tests/error_stab.rs — Added CooloffActive to roundtrip test; updated invalid-code test
• README.md — Added cooloff entrypoints and event to documentation tables

Security Changes

Type of Security Change

• SAST rule update
• Dependency vulnerability fix
• Exemption addition/renewal
• Security workflow modification
• Container image update
• Other: _______________

Vulnerability Details (if applicable)

CVE/Advisory ID:

• CVE-ID:
• GHSA-ID:

Affected Package:

• Name:
• Version:
• Severity: [ ] Critical [ ] High [ ] Medium [ ] Low

Fix Applied:

• Package version bump
• Code change to mitigate
• Configuration update
• Exemption granted (see below)

Exemption Request (if applicable)

Exemption ID: EXEMPT-___

Justification:

Mitigation Applied:

Expiry Date: YYYY-MM-DD (max 90 days from now)

Review Plan:

Testing

• Ran npm audit locally - output attached or no new vulnerabilities
• Security workflow passes on this branch
• Test suite passes: npm test
• Build succeeds: npm run build

Security Impact Analysis

Affected Components:

• Authentication/Authorization
• Payment processing
• Data encryption
• API endpoints
• Dependencies
• Container images
• CI/CD pipeline
• Other: _______________

Risk Assessment:

Documentation Updates

• Updated README.md (if workflow changed)
• Updated SECURITY-CI-SETUP.md (if process changed)
• Updated security-exemptions.json (if applicable)
• Added security notes to code comments

Checklist

• No secrets or keys committed
• No PII or sensitive data in logs
• All security scans pass (or exemptions documented)
• Branch protection requirements met
• Code review from security team (for critical changes)

Additional Notes

Test Output

# Paste npm test output here
npm test

# Paste npm audit output here (if relevant)
npm audit

CI Run Link

Workflow Run:

---

Security Review Required: @security-team
Compliance Impact: [Yes/No - explain if yes]

[drips-wave]

@muhsar27 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Solid change — thanks for the clear description. 👏