Validate cosigner_commitments on configure

[MCarlomagno]

/configure accepts auth.cosigner_commitments from the client and only verifies that the signer’s pubkey exists in the account state. The full list isn’t validated against the actual account storage, so incorrect or malicious auth config could be stored.

When configuring an account, extract signer commitments from initial_state and ensure they match auth.cosigner_commitments (same set/order as expected), otherwise reject

[HiteshMittal07]

Hi @MCarlomagno, I’d love to work on this issue. Could you please assign it to me? Thanks!

[MCarlomagno]

Hi @HiteshMittal07, for sure! feel free to open a PR

[ironor25]

hi @MCarlomagno i worked on it and solved the issue also ran test and it worked.