feat: address C4's issue#32

[thaixuandang]

Description

Based on the recommendation from @khangvv and the security team, I added a check in katanaV3SwapCallback to ensure that msg.sender is a pool, not an exploit address. I also retained the logic to verify using computePoolAddress, as suggested.

Checklist

• I have clearly commented on all the main functions following the NatSpec Format
• The box that allows repo maintainers to update this PR is checked
• I tested locally to make sure this feature/fix works