AVM: proper cross product check for app put and del

[jannotti]

Test: construct app that tries to modify a local state for which it only has access to the account, not the local state

[ahangsu]

mostly reasonable move, just up jason's find.

[codecov]

Codecov Report

Merging #5467 (573d0e4) into master (8ab4aad) will decrease coverage by 5.84%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #5467      +/-   ##
==========================================
- Coverage   55.63%   49.80%   -5.84%     
==========================================
  Files         447      447              
  Lines       63405    63409       +4     
==========================================
- Hits        35274    31578    -3696     
- Misses      25751    29408    +3657     
- Partials     2380     2423      +43     

Impacted Files	Coverage Δ
data/transactions/logic/eval.go	84.87% <100.00%> (-7.38%)	⬇️

... and 184 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[bbroder-algo]

This patch is repairing an oversight in group resource sharing which incorrectly made available to an application its own app local data for a different sender address (used in a different transaction in the group). While that different sender address is "available" under the new resource sharing rules, it should not imply that local data for all applications are available to read/write in that address. To enable read/write, the other address must be available in the foreign array of the same top-level transaction as the app call.

[ahangsu]

only one minor thing, but I think it should be good.

[jasonpaulos]

LGTM