fix: guard submitStep() against consent bypass via child @submit and forceComplete paths (#19)

* fix: guard submitStep() against consent bypass via child component @submit events

* fix: extend consent guard to cover forceComplete path and disable Complete button

---------

Co-authored-by: mario.pander <developbob50@gmail.com>

app/javascript/submission_form/form.vue

@@ -99,7 +99,7 @@
       type="submit"
       name="completed"
       value="true"
-      :disabled="isSubmittingComplete"
+      :disabled="isSubmittingComplete || (requireConsent && !consentAccepted)"
     >
       <span class="flex items-center">
         <IconInnerShadowTop
@@ -1646,10 +1646,14 @@ export default {
       return this.$refs.areas.scrollIntoArea(area)
     },
     async submitStep (e) {
-      this.isSubmitting = true
-
       const forceComplete = e?.submitter?.getAttribute('name') === 'completed'
 
+      if (this.requireConsent && !this.consentAccepted && (this.isLastStep || forceComplete)) {
+        return
+      }
+
+      this.isSubmitting = true
+
       if (forceComplete) {
         this.isSubmittingComplete = true
       }