The buyPolicyFor/addLiquidityFor should transfer funds from msg.sender
When calling the buyPolicyFor/addLiquidityFor functions, are called with the parameter _policyHolderAddr/_liquidityHolderAddr who is going to be the beneficiary in buying policy/adding liquidity:\\n```\\nfunction buyPolicyFor(\\n  address \\_policyHolderAddr,\\n  uint256 \\_epochsNumber,\\n  uint256 \\_coverTokens   \\n) external override {\\n  \\_buyPolicyFor(\\_policyHolderAddr, \\_epochsNumber, \\_coverTokens);\\n}\\n```\\n\\n```\\nfunction addLiquidityFor(address \\_liquidityHolderAddr, uint256 \\_liquidityAmount) external override {\\n  \\_addLiquidityFor(\\_liquidityHolderAddr, \\_liquidityAmount, false);\\n}\\n```\\n\\nDuring the execution, the funds for the policy/liquidity are transferred from the _policyHolderAddr/_liquidityHolderAddr, while it's usually expected that they should be transferred from `msg.sender`. Because of that, anyone can call a function on behalf of a user that gave the allowance to the `PolicyBook`.\\nFor example, a user(victim) wants to add some DAI to the liquidity pool and gives allowance to the `PolicyBook`. After that, the user should call `addLiquidity`, but the attacker can front-run this transaction and buy a policy on behalf of the victim instead.\\nAlso, there is a curious edge case that makes this issue Critical: _policyHolderAddr/_liquidityHolderAddr parameters can be equal to the address of the `PolicyBook` contract. That may lead to multiple different dangerous attack vectors.
Make sure that nobody can transfer funds on behalf of the users if it's not intended.
```\\nfunction buyPolicyFor(\\n  address \\_policyHolderAddr,\\n  uint256 \\_epochsNumber,\\n  uint256 \\_coverTokens   \\n) external override {\\n  \\_buyPolicyFor(\\_policyHolderAddr, \\_epochsNumber, \\_coverTokens);\\n}\\n```\\n