Contracts: add authorized publisher gate to datasource/schema registries

[driemworks]

Right now, schema registration and datasource registration is completely open and untrusted, meaning we have no gate for who can publish against a schema, and no verification that a datasource actually fits a schema. For now, we can maintain this as a 'trusted' operation (since the zkp verification path would require recursive proofs and significant time/research). That is:

• add an allowed publishers list in the schema registry
• add a gate in the datasource registry to check if the caller is an allowed publisher, reject if not