Fix CPI Guard bypass: block close_authority set to None during CPI

[victorchukwuemeka]

Problem

In processor.rs:772, the CPI Guard check for AuthorityType::CloseAccount requires new_authority.is_some():

if cpi_guard.lock_cpi.into() && in_cpi() && new_authority.is_some() {
return Err(TokenError::CpiGuardSetAuthorityBlocked.into());
}

This means setting close_authority = None during CPI bypasses the CPI Guard entirely. The AccountOwner path (line 737) does not have this condition.

Per the CPI Guard spec, SetAuthority should only allow removing an existing close authority during CPI -- but the guard should still be enforced.

Fix

Remove && new_authority.is_some() so set_authority(CloseAccount, None) is also blocked during CPI when CPI Guard is enabled.

Test

test_set_authority_with_cpi_guard_extension creates a token account with CPI Guard, enables it, and verifies that setting close_authority to both Some and None succeeds outside CPI (where in_cpi() returns false). A full CPI-path validation requires running against a Solana validator.