GHSA-725g-w329-g7qr: kora-lib: Token-2022 Transfer Fee Not Deducted During Payment Verification

When a user pays transaction fees using a Token-2022 token with a TransferFeeConfig extension, Kora’s verify_token_payment() credits the full raw transfer amount as the payment value. However, the on-chain SPL Token-2022 program withholds a portion of that amount as a transfer fee, so the paymaster’s destination account only receives amount - transfer_fee. This means the paymaster consistently credits more value than it actually receives, resulting in systematic financial loss.