Add protection against gas bombs in prize hooks

[trmid]

Gas bombs in hooks can be triggered in two ways:

1. returning excessively large data in _hookData for beforeClaimPrize which then gets copied to memory
2. reverting with an excessively large reason in either beforeClaimPrize or afterClaimPrize hook calls

Gas bombs can be used to drain the remaining call gas and cause entire batch claims to revert, making it difficult for bots to detect, pinpoint, and mitigate the hook failure. To mitigate this behaviour, the ExcessivelySafeCall library is used to limit the return data that is copied to memory.

The prize vault claimPrize function is modified to safely revert if the beforeClaimPrize function returns more than 32 bytes of additional hookData. In addition, if any revert messages are thrown by either hook calls that exceed the total allowed limit of 128 bytes, a generic error will be thrown instead.

By limiting the return data of hook calls, the behaviour of claimPrize is more predictable and claimer bots will not be susceptible gas bombs.

[linear]

GEN-1778 [163] add protection against gas bombs in prize hooks

[github-actions]

LCOV of commit 8b26879 during coverage #584

Summary coverage rate:
  lines......: 99.6% (246 of 247 lines)
  functions..: 100.0% (66 of 66 functions)
  branches...: no data found

Files changed coverage rate:
                              |Lines       |Functions  |Branches    
  Filename                    |Rate     Num|Rate    Num|Rate     Num
  ==================================================================
  src/abstract/Claimable.sol  | 100%     26| 100%     5|    -      0

[asselstine]

Interesting case! Looks good, just feels like it might be not enough? Curious to hear your thoughts

[asselstine]

Is three words enough? Do we have more examples to help inform this?

[trmid]

3 words for the entire return data is enough for 32 bytes of _hookData to be passed back from the beforeClaimPrize call. We haven't seen a lot of uses for hook data yet, so it's a pretty arbitrary choice, but it's a way to keep gas costs low while still allowing some data to be passed through. In hindsight, the new transient storage opcodes will probably be used more than this hook data for any meaningful state storage across calls, but the prize vault should still keep this interface intact to be backwards-compatible with previous hooks.

[github-actions]

LCOV of commit e328b31 during coverage #590

Summary coverage rate:
  lines......: 99.6% (251 of 252 lines)
  functions..: 100.0% (66 of 66 functions)
  branches...: no data found

Files changed coverage rate:
                              |Lines       |Functions  |Branches    
  Filename                    |Rate     Num|Rate    Num|Rate     Num
  ==================================================================
  src/abstract/Claimable.sol  | 100%     26| 100%     5|    -      0