fungible-token: allow contract-caller to send own token

[friedger]

Description
The contract fungible-token.clar has limited composability feature for defi products.

Currently, when a defi contract wants to transfer tokens that it holds it needs to use (as-contract (contract-call? token transfer ..)).
This is dangerous because malicious tokens have access to all assets the contract holds.

Solution
Relax assert to allow contract-caller to send own token. Replace asserts in transfer function with
(asserts! (or (is-eq tx-sender sender) (is-eq contract-caller sender)) ERR_UNAUTHORIZED)

[MarvinJanssen]

I agree and have always advocated for this change. In fact, I would even want to supersede the SIP010 document with a safe-transfer standard. There are contracts out there with and without the more lenient guard, which makes using SIP009/SIP010 tokens in DeFi rather problematic.