Malicious target can make `_endVote()` revert forever by forceUnstaking/staking again
In `_endVote()`, we update `forfeitedStakeWei` or `lockedStakeWei[target]` according to the target's staking status.\\n```\\nFile: contracts\\OperatorTokenomics\\SponsorshipPolicies\\VoteKickPolicy.sol\\n    function _endVote(address target) internal {\\n        address flagger = flaggerAddress[target];\\n        bool flaggerIsGone = stakedWei[flagger] == 0;\\n        bool targetIsGone = stakedWei[target] == 0;\\n        uint reviewerCount = reviewers[target].length;\\n        // release stake locks before vote resolution so that slashings and kickings during resolution aren't affected\\n        // if either the flagger or the target has forceUnstaked or been kicked, the lockedStakeWei was moved to forfeitedStakeWei\\n        if (flaggerIsGone) {\\n            forfeitedStakeWei -= flagStakeWei[target];\\n        } else {\\n            lockedStakeWei[flagger] -= flagStakeWei[target];\\n        }\\n        if (targetIsGone) {\\n            forfeitedStakeWei -= targetStakeAtRiskWei[target];\\n        } else {\\n            lockedStakeWei[target] -= targetStakeAtRiskWei[target]; //@audit revert after forceUnstake() => stake() again\\n        }\\n```\\n\\nWe consider the target is still active if he has a positive staking amount. But we don't know if he has unstaked and staked again, so the below scenario would be possible.\\nThe target staked 100 amount and a flagger reported him.\\nIn `onFlag()`, `lockedStakeWei[target]` = targetStakeAtRiskWei[target] = 100.\\nDuring the voting period, the target called `forceUnstake()`. Then `lockedStakeWei[target]` was reset to 0 in `Sponsorship._removeOperator()`.\\nAfter that, he stakes again and `_endVote()` will revert forever at L195 due to underflow.\\nAfter all, he won't be flagged again because the current flagging won't be finalized.\\nFurthermore, malicious operators would manipulate the above state by themselves to earn operator rewards without any risks.
Perform stake unlocks in `_endVote()` without relying on the current staking amounts.
Malicious operators can bypass the flagging system by reverting `_endVote()` forever.
```\\nFile: contracts\\OperatorTokenomics\\SponsorshipPolicies\\VoteKickPolicy.sol\\n    function _endVote(address target) internal {\\n        address flagger = flaggerAddress[target];\\n        bool flaggerIsGone = stakedWei[flagger] == 0;\\n        bool targetIsGone = stakedWei[target] == 0;\\n        uint reviewerCount = reviewers[target].length;\\n        // release stake locks before vote resolution so that slashings and kickings during resolution aren't affected\\n        // if either the flagger or the target has forceUnstaked or been kicked, the lockedStakeWei was moved to forfeitedStakeWei\\n        if (flaggerIsGone) {\\n            forfeitedStakeWei -= flagStakeWei[target];\\n        } else {\\n            lockedStakeWei[flagger] -= flagStakeWei[target];\\n        }\\n        if (targetIsGone) {\\n            forfeitedStakeWei -= targetStakeAtRiskWei[target];\\n        } else {\\n            lockedStakeWei[target] -= targetStakeAtRiskWei[target]; //@audit revert after forceUnstake() => stake() again\\n        }\\n```\\n