[Bug/Investigation] Components CPI caller check

**Describe the bug**
Components make use of `solana_program::sysvar::instructions::get_instruction_relative` to enforce that they are called from CPI and the identify of the caller, e.g.: https://github.com/magicblock-labs/bolt/blob/main/programs/bolt-component/src/lib.rs#L11

This may contains a bug, since a transaction could contain a valid instruction at index [0], but be malicious .

**Proposed solution**
- Investigate if that's the case and add stronger test cases and fixes if needed.
- Investigate an alternative solution, e.g. invoke the systems/components signing with a PDA