feat: address C4's issue#32

[thaixuandang]

Description

Based on the recommendation from @khangvv and the security team, I added a check in verifyCallback to ensure that msg.sender is a pool, not an exploit address. I also retained the logic to verify using computePoolAddress, as suggested.

Notice that this modification, besides impacting NonfungiblePositionManager, will also affect the QuoterV2 and MixedRouteQuoterV1 contracts.

Checklist

• I have clearly commented on all the main functions following the NatSpec Format
• The box that allows repo maintainers to update this PR is checked
• I tested locally to make sure this feature/fix works