fix: evaluate friendly-fire bypass on the attacker

[darbyjack]

Summary

Evaluate guild and ally friendly-fire bypass permissions on the player causing damage rather than the player receiving it.

Root cause

The melee, projectile, and flame-arrow handlers checked guilds.ffa.guild and guilds.ffa.ally on the victim. Because operators implicitly have all permissions, attacks against an operator bypassed friendly-fire protection while the operator's return attacks remained blocked.

Changes

• check melee friendly-fire bypass permissions on the attacker
• check projectile friendly-fire bypass permissions on the shooter
• check flame-arrow friendly-fire bypass permissions on the shooter
• apply the same correction to both guild-member and allied-player checks
• retain the existing harmful splash-potion behavior, which already checks the shooter

Validation

• verified the branch contains one commit and modifies only EntityListener.java
• reviewed the generated diff: six victim permission checks now consistently use the attacker, with no unrelated changes

Fixes #689