Declare a minimum drupal/commerce version of ^3.3.9 (requires commerce_payment.order.merchant_return route and the payment-add-form billing address book refresh)

Problem/Motivation

commerce_authnet's composer.json requires:

"drupal/commerce": "^3"

with no minimum patch version, but PaymentMethodAddForm (src/PluginForm/AcceptHosted/PaymentMethodAddForm.php) depends on two commerce core changes that only shipped in Commerce 3.3.9:

1. commerce_payment.order.merchant_return route. createContexts() builds continueUrl with:

$continue_url = Url::fromRoute('commerce_payment.order.merchant_return', [
'commerce_order' => $order->id(),
'commerce_payment_gateway' => $payment_gateway->id(),
], ['absolute' => TRUE])->toString();

This route (commerce_payment.routing.yml, routed to OrderPaymentController::merchantReturn) doesn't exist before 3.3.9. On an older Commerce release, Url::fromRoute() throws a RouteNotFoundException as soon as a merchant uses the admin "Add payment method" form with the Accept Hosted gateway.
2. Billing address book save/refresh on the payment method add form, from issue #3586506: "Add a 'Save' button for new address entry and refresh the payment method add form when it's submitted". buildConfigurationForm() and createContexts() both assume this structure exists:

$form['billing_information']['copy_to_address_book']['#access'] = FALSE;
// ...
$inline_form = $form['billing_information']['#inline_form'];
$contexts['billing_profile'] = $inline_form->getEntity();

Before this fix, the billing_information element on the payment method add form doesn't expose a copy_to_address_book control or an #inline_form in this shape, so this code either silently no-ops the wrong thing or errors depending on what actually is present.

Both #3538210 (iframe/JS payment methods on the Add payment form, covered in a separate related issue) and #3586506 landed together in Commerce 3.3.9. Since commerce_authnet's constraint is only ^3, Composer will install it against any older 3.x Commerce release, and these incompatibilities only surface at runtime rather than at install/update time.

Proposed resolution

Bump the constraint in commerce_authnet's composer.json to:

"drupal/commerce": "^3.3.9"

so Composer refuses to install commerce_authnet against a Commerce release that predates the route and payment-add-form billing behavior it depends on.