Default Instruction implementation allows invalid CreditReceiver allocation

[kindofdev]

Hello, I think there's an issue on CreditReceiver allocation.
The way is implemented allows the following scenario:

-- 
--  INSTRUCTION:
-- 
--            bank
--  sender ---------> receiver
--
--
--  ACCOUNTS:
-- 
--              bank
--           /         \
--    sender         receiver
--
--  bank allocates with CreditReceiver
--  
--

For instance:

-- Allocate instruction
  (cashInstructionCid, _) <- submit bank do
    exerciseCmd cashInstructionCid Instruction.Allocate with
      actors = Set.singleton bank; allocation = CreditReceiver

  -- Approve instruction
  cashInstructionCid <- submit receiver do
    exerciseCmd cashInstructionCid Instruction.Approve with
      actors = Set.singleton receiver; approval = TakeDelivery receiverAccount

  -- Settle batch
  submitMultiMustFail [bank] [publicParty] do
    exerciseCmd batchCid Batch.Settle with actors = Set.singleton bank

daml-finance/src/main/daml/Daml/Finance/Settlement/Instruction.daml

Line 116 in 66495d0

CreditReceiver -> do

 CreditReceiver -> do
   allMustAuthorize $ Set.singleton routedStep.custodian
   pure allocation

I would say that the code bellow might fix the issue:

 CreditReceiver -> do
   allMustAuthorize $ Set.singleton routedStep.custodian
   mustBe this Custodian routedStep.sender
   pure allocation