Fix federation of admin actions (fixes #3980)

[Nutomic]

Lemmy is not correctly verifying federated mod actions which are performed by instance admins. Instead of checking that the mod action comes from the community instance, it was comparing against the object instance. This works fine as long as the affected object is located on the community instance, but fails in case of remote objects. This PR fixes the behaviour and changes the test case to verify this.

This is a major issue with moderation, we should consider publishing the fix in an 0.18.5 release.

[Nothing4You]

do i understand it correctly that now the user's instance admin is no longer able to remove a user's posts (with federation)?
is this intentional and by design?

a malicious/compromised instance can already spoof removals to be federated as removed by user when it's removed by an admin of the user's instance, so there would not be any federation trust impact from allowing this.

edit for clarification:

example use cases for this: someone registers an account purely for harassment, such as spamming, posting untagged nsfw content in non-nsfw communities and other similar things.

[dessalines]

I hope the cherry-picking isn't too bad for this one if we want to do a 0.18.5 release.