[security] Claim only to `msg.sender`

[MaxMustermann2]

Currently, our claim function is as follows.

function claim(address token, uint256 amount, address recipient)

However, it should be changed to this.

function claim(address token, uint256 amount)

This is to reduce the attack vector, and align with the advice that Exocore acts a trust-minimized L1 and that the withdrawal address equals the deposit address for all stakers.

[adu-web3]

the recipient is later added as a feature: staker could specify a destination address(an EOA address or a contract address) as recipient address. If we remove this argument, we would disable this feature. So it depends on whether we need this feature