maxDeposit & maxMint not respecting lending whitelist

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/d968f256462469239ec7394171409ed76dab03e1/src/contracts/FraxlendPair.sol#L137
https://github.com/code-423n4/2022-08-frax/blob/d968f256462469239ec7394171409ed76dab03e1/src/contracts/FraxlendPair.sol#L141

Vulnerability details

Impact & Proof Of Concept

EIP-4626 states for maxDeposit and maxMint: "MUST factor in both global and user-specific limits, like if deposits are entirely disabled (even temporarily) it MUST return 0."

Therefore, when the lender whitelist is active and the callee of these functions is not an approved lender, it MUST return 0, which it currently does not.

Rationale for high risk: In a previous contest, a similar issue was marked high risk with the following reasoning:

EIP4626 is aimed to create a consistent and robust implementation patterns for Tokenized Vaults. A slight deviation from 4626 would broke composability and potentially lead to loss of fund (POC in code-423n4/2022-06-notional-coop-findings#88 can be an example). It is counterproductive to implement EIP4626 but does not conform to it fully.

Recommended Mitigation Steps

Check if the lender is approved, return 0 if this is not the case.

[amirnader-ghazvini]

Duplicate of #79