Fix: prevent setExpenditureState from bypassing isValidLocalSkill /claim #1346

[jialfaro]

Summary

Fixes #1346: Prevents setExpenditureState from bypassing isValidLocalSkill checks when writing to expenditure slots.

Details

• Enforces strict validation in setExpenditureState for slot EXPENDITURESLOTS_SLOT (the skills field).
• Only allows indexing skills[0], requiring that any written value passes isValidLocalSkill(uint256(_value)).
• For all other fields, strictly requires keys.length == 2.
• Prevents accounts with the Arbitration role from arbitrarily attaching global network skillIds to expenditure slots and awarding unearned reputation in global skills.

Key Changes

• contracts/colony/ColonyExpenditure.sol:
  • Added enforcement requiring keys.length == 2, with a controlled exception for offset == 3 (skills) where keys.length == 3 is permitted strictly for skills[0] guarded by isValidLocalSkill(uint256(_value)).

Verification

1. Review logic in ColonyExpenditure.sol: setExpenditureState validates skill locality.
2. Run test suite (test/contracts-network/colony-expenditure.js) to confirm zero regressions.
3. Repro check: Writing skills.length = 1 via setExpenditureState (keys.length == 2), then attempting to write skills[0] with an invalid/global skillId via keys.length == 3 now correctly reverts with colony-not-valid-local-skill.

Closes #1346
/claim #1346