Fix: Potential transfer bypass vulnerability

[rickymcalister]

The current validateTransfer check appears to have a subtle flaw; it only checks if msg.sender is different from tx.origin. It doesn't check if msg.sender is a contract.

A malicious EOA could potentially create a contract that simply calls the transfer function. Because msg.sender (the malicious contract's address) would be different from tx.origin (the malicious EOA's address), the allowlist check for msg.sender would be bypassed. This means the malicious EOA could effectively transfer tokens even if their contract (and therefore indirectly, themselves) is not on the allowlist.

The modifier should explicitly check if msg.sender is an EOA before skipping the allowlist check.