uncommit sends tokens to the wrong user

Handle cmichel Vulnerability details The PoolCommitter.uncommit function calls the ILeveragedPoolleveragedPool.quoteTokenTransfer/mintTokens function with msg.sender. But in uncommit's case that's the pool, not the commit owner, see onlyPool modifier on executeAllCommitments which calls uncommit...