Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

Description The VM built-in function KleverUpdateAccountPermission registered always-active, creator.go:381-390 / core/vmconstants.go:234 rewrites an account's entire permission set. Its authorization check uses vmInput.RecipientAddr attacker-controlled instead of the authenticated...