Resolves Issue #1791: Require private contacts for registry org creation

[afoote-mitre]

Closes Issue #1791

Summary

Requires two private contacts when creating a registry organization.

Org creation now enforces the policy that new registry orgs must include at least two private_contacts, while leaving existing org update validation unchanged. This applies to both registry org creation paths and returns a standard validation error when fewer than two private contacts are provided.

Important Changes

src/repositories/baseOrgRepository.js

• Added create-specific org validation with a minimum of two private_contacts.
• Keeps the existing update validation behavior unchanged.

src/controller/org.controller/org.controller.js

• Uses create-specific validation for registry org creation through the public org controller path.

src/controller/registry-org.controller/registry-org.controller.js

• Uses create-specific validation for the registry org controller create path.

schemas/registry-org/create-registry-org-request.json

• Requires private_contacts.
• Adds minItems: 2 for create requests.

src/controller/org.controller/index.js

• Updates the registry org creation API example to include two private contacts.

test/integration-tests/**

• Updates registry org creation fixtures to include valid private contacts.
• Adds regression coverage for rejecting registry org creation with fewer than two private contacts.

Testing

Steps to manually test updated functionality:

• 1. Run integration tests: bash -i -c "npm run test:integration".
• 2. Verify POST /api/registry/org with zero or one private contact returns 400.
• 3. Verify POST /api/registry/org with two private contacts succeeds.
• 4. Verify existing registry org update flows are not newly blocked by this create-only requirement.

[david-rocca]

This PR works when creating using an org on the new "registry" endpoints. However, you can still make an org with the legacy endpoints, then are free to edit it with the "registry" endpoints without the restriction.

We need to decide on how / if we want to handle that before merging.

[david-rocca]

See Teams Comments