Submitted by bin2chen, also found by 0xbepresent and MatricksDeCoder
If the recipient maliciously enters the blacklist of priceToken, it may cause rngComplete() to fail to execute successfully.
The current implementation of RngRelayAuction.rngComplete() immediately transfers the prizeToken to the recipient.
There is a risk that if prizeToken is a token with a blacklisting mechanism, such as :USDC.
Then recipient can block rngComplete() by maliciously entering the USDC blacklist.
Since RngAuctionRelayer supports AddressRemapper, users can more simply specify blacklisted addresses via remapTo()
Add claims mechanism, rngComplete() only record cliamable[token][user]+=rewards.
Users themselves go to claims.
Context
asselstine (PoolTogether) confirmed
