fix(beth): check the payout address before a burn #12

What

tokens::beth::redeem::submit_withdraw does not check the destination of the withdraw account that it burns into. Another client can create a BETH withdraw account that pays the zero address or a BETH bridge proxy. The bridge reverts both payouts, so the burn never gets a payout.

PR #11 adds CantonBridgeV1::check_payout_destination for CHYPE. BETH uses the default, which refuses nothing.

Proposed fix

• Implement check_payout_destination for Beth: refuse the zero address and the three BETH bridge proxies.
• Let Beth::validate_destination call it, as Chype::validate_destination does.
• Add a test that submit_withdraw refuses such an account before any request.

Why it is a follow-up

The change alters BETH behaviour, and PR #11 is about CHYPE only.