Permission moveFundsBetweenPots properly for voting

[area]

This is my take at fixing up moveFundsBetweenPots so that what movement of funds are allowed is consistent regardless of whether the function is being executed directly or a motion has been made.

I tried a couple of other ways, but there just simply isn't enough information provided in the combination of the existing action and the existing motion creation function. You have to prove:

The domain I have the permission in is a parent of the 'fromPot' domain
The domain I have the permission in is a parent of the 'toPot' domain
The domain the vote is taking place in is a parent of the 'fromPot' domain
The domain the vote is taking place in is a parent of the 'toPot' domain

But we only have three proofs, between createMotion and the action if we create special functions to extract the second proof from the action. The action would provide the first two, but there's no way to prove both of the second with a single proof.

Stepping back, I realised that we're in this predicament is because there is an ambiguity in the general case for moveFundsBetweenPots as to which domain we're acting in. Consider the domain hierarchy:

      A 
      |
      B
    /   \
   C     D

Let's say I have the permission explicitly in A, and I want to move funds from C to D. What domain am I acting in? We could say it's A by convention, but that would mean it would be impossible to have a vote in B about this, which clearly should be allowed. There's no way to specify which domain we're acting in. So the solution I've implemented here adds a new moveFundsBetweenPots that removes this ambiguity. It still includes multiple domain proofs, but those now prove that the domain we're acting in is a parent of C and a parent of D and so don't need to be considered for the creation of the motion, nor do they need to meet the unofficial standard we've adopted (which the proof for 'which domain we're acting in' does, and therefore plays nicely with the motions and disputes).