Default simulation and authorizeInvocation to CAP-71 v2 address credentials

[Ryang-21]

What

CAP-71 SOROBAN_CREDENTIALS_ADDRESS_V2 credentials become the default on both ends of the Soroban auth flow, now that the network runs protocol 27. rpc.Server.simulateTransaction's useUpgradedAuth and authorizeInvocation's authV2 both default to true, so simulation asks RPC to record v2 entries and authorizeInvocation builds them. Pass false to either one for the legacy SOROBAN_CREDENTIALS_ADDRESS format. Both flags stay transitional and become no-ops when v2 is mandatory in protocol 28.

simulateTransaction also now always sends useUpgradedAuth in the JSON-RPC request, where it previously omitted the field when the flag was unset. The useUpgradedAuth default reaches everything built on simulation, including contract.AssembledTransaction.simulate() and the useUpgradedAuth method option.

Two things break for callers. Code that reads the credential arm by hand has to handle addressV2 and not just address, or switch to inspectAuthEntry, which normalizes the arms. And a hand-rolled signer that hardcodes the legacy ENVELOPE_TYPE_SOROBAN_AUTHORIZATION preimage now produces signatures the network rejects, so it should use buildAuthorizationEntryPreimage or authorizeEntry, both of which pick the address-bound payload off the entry itself. SDK-driven signing (contract.Client, authorizeEntry, signAuthEntries) needs no change: it signs whichever credential the entry carries.

Tests cover both defaults and both opt-outs. The simulation fixture in simulate_transaction.test.ts pins authV2: false, since it rebuilds and asserts on the legacy arm. The changelog entry goes under a new ## Unreleased heading rather than the published v17.0.0-rc.1 section, and the migration guide, the Protocol 27 auth guide, and the contract-auth guide are updated to describe v2 as the default instead of opt-in.