Fix CPI duplicate account privilege escalation

[Lichtso]

Problem

#22107 introduced a privilege escalation bug:
If a CPI uses duplicate Pubkeys only the privileges of the first were verified.

Summary of Changes

• Moves CPI privilege verification out of deduplication loop.
• Modifies TEST_PRIVILEGE_ESCALATION_SIGNER and TEST_PRIVILEGE_ESCALATION_WRITABLE to cover duplicate entries as well.

Fixes #

[codecov]

Codecov Report

Merging #22752 (7a3d23d) into master (071e970) will increase coverage by 0.0%.
The diff coverage is 53.3%.

@@           Coverage Diff           @@
##           master   #22752   +/-   ##
=======================================
  Coverage    81.5%    81.5%           
=======================================
  Files         558      558           
  Lines      149899   149901    +2     
=======================================
+ Hits       122189   122224   +35     
+ Misses      27710    27677   -33     

[jstarry]

Fix looks good, would be nice to have separate tests for both original and dupe account privilege escalation though for future protection

[ryoqun]

lgtm (i second with @jstarry 's comment about separate tests; also backporting only those new tests would be a bonus; i mean it seems that our test suite lacked this duplicate account privilege escalation case in the first case. and that allowed this bug slipped in, right?).

Pull request has been modified.