Additional fixes

[lachlanglen]

• (Donation) If referrer_id is caller or recipient, ignore it
• Use saturating_mul when calculating fees to prevent (extremely unlikely) u128 overflow during multiplication
• Move location of assert_max_projects_not_reached to only run when approving application
• Fix logic in owner_set_admins (ensure existing set is cleared; ensure insertion of new admins rather than removal)
• Refund unused deposit in all admin methods that require deposit for security purposes