Restores the allocation-bounds loop in init() and
SetConfigurableConsensusProtocols by providing the
checkSetAllocBounds function the SDK previously lacked.
Addresses algorand/go-algorand-sdk#757.

skip-checks: true

Large integers outside Number.MAX_SAFE_INTEGER were written as raw JSON
numbers. The AVM VS Code debugger (js-algorand-sdk v3) loses precision on
those values. Convert them to strings when persisting .trace.avm.json.

Closes #199.

Co-authored-by: Dr Alex Mitre <30060514+mitre88@users.noreply.github.com>
Co-authored-by: Joe Polny <joepolny@gmail.com>

AppClient error transformers matched app IDs with a substring check
(`"app=1142" in str(error)`), so a transformer for app 1142 could claim
errors for app 11423 and transform them with the wrong source map.

Match with a digit boundary (`app={id}(?!\d)`) instead.

Closes #296.

Co-authored-by: Dr Alex Mitre <30060514+mitre88@users.noreply.github.com>
Co-authored-by: Joe Polny <joepolny@gmail.com>

skip-checks: true

BeforeTxnGroup mirrors the budget the AVM grants, but it has never matched
what NewInnerEvalParams actually does. Two separate errors, both present
since the code was first written:

Budget was credited once per inner group rather than once per inner app
call. An inner group of payments wrongly added MaxAppProgramCost, and an
inner group holding several app calls added only one grant instead of one
per call. This only ever affected the reported figure, not the budget the
group really ran with.

ExtraOpcodeBudget from a simulate request was applied in every call to
BeforeTxnGroup, so a group with N inner groups was granted it N+1 times.
Unlike the above, that one added to PooledApplicationBudget itself, so
simulate handed out a multiple of the budget that was asked for and could
approve a group that would run out of budget on chain.

Neither was caught because the tests exercise extra budget and inner
groups on separate axes, and every inner group in them holds exactly one
app call, which is the single case where the first error is invisible.

Direct-dev-pin GitPython>=3.1.58 so pip-audit stops failing on the
15 advisories in the 3.1.50 copy pulled in by python-semantic-release.
Same pattern already used for pygments, requests, and filelock.

Co-authored-by: Dr Alex Mitre <30060514+mitre88@users.noreply.github.com>