Prohibit self-withdrawals from Vote accounts

[grod220]

Problem

The Vote Program allows a Vote account to be both the source and destination of Withdraw. When the authorized withdrawer requests the full balance, the program zeroes the account's state, then subtracts and re-adds the lamports to the same underlying account. The transaction succeeds with the balance unchanged and the state erased. This leaves a funded, rent-exempt, and uninitialized Vote account. Another party can then initialize it with their own validator identity and authorities, taking control of the retained balance.

Proposal

Reject all Vote account self-withdrawals with InvalidArgument err.

Because Vote remains a native builtin, this is a consensus-impacting change requiring a feature gate and matching behavior across validator clients.

Precedent

The Stake Program already rejects self-withdrawals with InvalidArgument. See solana-program/stake#96.

[buffalojoec]

+1 for me!

[joncinque]

Another no-brainer, sounds great to me!