review endowments

[mhofman]

What is the Problem Being Solved?

Endowments (#9304) merged without a thorough review (#9566), and seem to have bugs (e.g. #9830)

Description of the Design

Full review of #9933

In particular, one question that came up: why do endowments need to create durable unwrappers? This would result in a leak of state unwrapper instances every time the contract is restarted. See makeStateUnwrapper.

Or is there any check that all previously replaced endowments are replaced in the same way? With clear errors if not.

Security Considerations

Correctness

Scaling Considerations

No leak or growth per incarnation

Test Plan

See #9933

Upgrade Considerations

It must work