Verify signature ownership in esign accept/record-event flows

Any self-provisioned trust center visitor could accept another
visitor's NDA signature or inject audit-trail events into it by
supplying its GID, since AcceptSignature and RecordEvent trusted the
client-supplied signature ID without checking it belonged to the
caller (GHSA-22xj-f767-ppw6). SignerEmail/ActorEmail are always
derived from the verified session identity, never client input, so
comparing them against the signature's stored SignerEmail in
pkg/esign/service.go closes the hole at its root without touching the
resolver-level authorization already in place elsewhere.

Adds an e2e regression test that self-provisions two trust center
visitors through the real magic-link flow and confirms one cannot
touch the other's signature.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/esign/errors.go

@@ -18,4 +18,5 @@ import "errors"
 
 var (
 	ErrElectronicSignatureNotFound = errors.New("electronic signature not found")
+	ErrSignatureAccessDenied       = errors.New("signature does not belong to the caller")
 )