Add onlyBootloader check to Paymaster.sol

[Smeagol1907]

The base Paymaster contract's validateAndPayForPaymasterTransaction() did not restrict the caller to the bootloader, unlike the pattern used elsewhere for ZKsync paymasters (e.g. checking msg.sender == BOOTLOADER_FORMAL_ADDRESS).

Since this function sends requiredETH (derived entirely from the caller-supplied _transaction fields) to the bootloader address on every call, anyone could call it directly and drain the paymaster's ETH balance by supplying an arbitrarily large gasLimit / maxFeePerGas, without going through a real transaction.

Added a NotFromBootloader error and a check at the top of validateAndPayForPaymasterTransaction() that reverts unless msg.sender == BOOTLOADER_FORMAL_ADDRESS, consistent with how other Abstract paymasters guard this entrypoint.

This contract is currently undocumented in the README and may not be in active use, so flagging as a hardening fix rather than a live exploit report.

---

PR-Codex overview

This PR introduces a new error handling mechanism in the Paymaster contract to ensure that only the bootloader can initiate certain transactions, enhancing security and validation.

Detailed summary

• Added a new error NotFromBootloader() to handle unauthorized calls.
• Introduced a check in the transaction function to revert if the msg.sender is not the BOOTLOADER_FORMAL_ADDRESS.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}