LootBox - plunder should disallow plundering to address(0)
Anyone can call `LootboxController.plunder()` to plunder on behalf of a `tokenId` owner. If a `LootBox` received an AirDrop but no `NFT` was issued to an owner (yet) this might open up an opportunity for a malicious actor to call `plunder()` in an attempt to burn the ETH and any airdropped tokens that allow transfers to `address(0)`.\\nNote:\\nDepending on the token implementation, transfers may or may not revert if the `toAddress == address(0)`, while burning the `ETH` will succeed.\\nThis might allow anyone to forcefully burn received `ETH` that would otherwise be available to the future beneficiary\\nIf the airdrop and transfer of `LootBox` ownership are not done within one transaction, this might open up a front-running window that allows a third party to burn air-dropped `ETH` before it can be claimed by the `owner`.\\nconsider one component issues the airdrop in one transaction (or block) and setting the `owner` in a later transaction (or block). The `owner` is unset for a short duration of time which might allow anyone to burn `ETH` held by the `LootBox` proxy instance.\\n`plunder()` receiving the `owner` of an `ERC721.tokenId`\\n```\\nfunction plunder(\\n  address erc721,\\n  uint256 tokenId,\\n  IERC20[] calldata erc20s,\\n  LootBox.WithdrawERC721[] calldata erc721s,\\n  LootBox.WithdrawERC1155[] calldata erc1155s\\n) external {\\n  address payable owner = payable(IERC721(erc721).ownerOf(tokenId));\\n```\\n\\nThe modified `ERC721` returns `address(0)` if the owner is not known\\n```\\n \\* @dev See {IERC721-ownerOf}.\\n \\*/\\nfunction ownerOf(uint256 tokenId) public view override returns (address) {\\n    return \\_tokenOwners[tokenId];\\n}\\n```\\n\\nWhile `withdraw[ERC20|ERC721|ERC1155]` fail with `to == address(0)`, `transferEther()` succeeds and burns the eth by sending it to `address(0)`\\n```\\nfunction plunder(\\n  IERC20[] memory erc20,\\n  WithdrawERC721[] memory erc721,\\n  WithdrawERC1155[] memory erc1155,\\n  address payable to\\n) external {\\n  \\_withdrawERC20(erc20, to);\\n  \\_withdrawERC721(erc721, to);\\n  \\_withdrawERC1155(erc1155, to);\\n  transferEther(to, address(this).balance);\\n}\\n```\\n
Require that the destination address `to` in `plunder()` and `transferEther()` is not `address(0)`.
```\\nfunction plunder(\\n  address erc721,\\n  uint256 tokenId,\\n  IERC20[] calldata erc20s,\\n  LootBox.WithdrawERC721[] calldata erc721s,\\n  LootBox.WithdrawERC1155[] calldata erc1155s\\n) external {\\n  address payable owner = payable(IERC721(erc721).ownerOf(tokenId));\\n```\\n