“The [Bosch Project’s] (at the very least) unprofessional manner of proceeding when offering its conclusions … not only contravenes the contractual conditions of the loan but also suggests that the Museo del Prado accepts and authorizes the proposed attributions.”