fix(zoe): assert that amountKeywordRecord is a copyRecord

[katelynsills]

BREAKING CHANGE: amountKeywordRecord must be hardened before passing to zcfMint and zcfSeat methods

Note: because this is a breaking change, we may want to wait to merge until we have other Zoe input validation complete, so there's only one breaking change to Zoe.

closes: #4061

Description

This PR changes the code of zcfMint.burnLosses, zcfMint.mintGains, zcfSeat.incrementBy, and zcfSeat.decrementBy to assert that the user-defined amountKeywordRecord is actually a keyword record and coerce the amounts. This means checking that it is a copyRecord, among other things. The actual function used is coerceAmountKeywordRecord from cleanProposal.js.

coerceAmountKeywordRecord requires a hardened object, thus, this is a breaking change. Any amountKeywordRecord not hardened will cause the function to throw.

Security Considerations

This is part of the input validation that we need to do for Zoe, but not the entirety of it. #4068 is the input validation task covering all of Zoe.

Documentation Considerations

This is a breaking change that will effect dapps. We should explain the need to harden in our documentation.

Testing Considerations

No additional tests needed.

[erights]

LGTM

[erights]

Ideally the creator of an object is the one to harden the object before releasing it. The typical and best case, as in the remaining harden here, is on the object literal itself. Otherwise, things should only be passing hardened objects to each other. The receiver should be defensively checking and rejecting, as incrementBy already does. It should not be doing its own defensive hardening, as that masks bugs in the source of the object. For example, if decrementBy returned an unhardened object, the defensive harden would mask the bug. In this case it is fine because decrementBy is not buggy in this way.

Suggested change

	lenderSeat.incrementBy(
	harden(repaySeat.decrementBy(harden({ Loan: debt }))),
	);
	lenderSeat.incrementBy(repaySeat.decrementBy(harden({ Loan: debt })));

Please correct all places where this PR makes this error.

This will also cause some error messages to revert to what they were before this PR. IMO the old error messages were better anyway, so this is welcome.

[katelynsills]

Hmm, I'm not seeing how this will cause some error messages to revert. I would expect the effect to be the same.

But, I just removed all of the harden calls on outputs from incrementBy and decrementBy, since they are already hardened.