When `selector` corresponds to `disableModule(address,address)`, `Guard._checkTransaction` function has an error for executing `_revertNonWhitelistedExtension(extension)` with `extension` being `prevModule` instead of `module`
Audit: 2024-01-renft-findings
Severity: HIGH

# Lines of code

https://github.com/re-nft/smart-contracts/blob/cbf5ff74e40576be72090afd99bf6f0c366bd315/src/policies/Guard.sol#L195-L293
https://github.com/re-nft/smart-contracts/blob/cbf5ff74e40576be72090afd99bf6f0c366bd315/src/libraries/RentalConstants.sol#L57-L62
https://github.com/re-nft/smart-contracts/blob/cbf5ff74e40576be72090afd99bf6f0c366bd315/src/policies/Guard.sol#L108-L116
https://github.com/safe-global/safe-contracts/blob/f8bd2159b64392d5b594f4e056be258ade2fefab/contracts/base/ModuleManager.sol#L57-L70


# Vulnerability details

## Impact
The `Guard._checkTransaction` function has an error for executing `_revertNonWhitelistedExtension(extension)` with `extension` being `prevModule` instead of `module` when the `selector` corresponds to `disableModule(address,address)`. Since calling `_revertNonWhitelistedExtension(extension)` with `extension` being `prevModule` would not revert if `prevModule` is whitelisted, the renter, who is the safe owner, can make the safe to call the `ModuleManager.disableModule` function to disable `module` that has become non-whitelisted and should not be allowed to be disabled.

## Proof of Concept
When the `selector` corresponds to `disableModule(address,address)`, calling the following `Guard._checkTransaction` function would execute `address extension = address(uint160(uint256(_loadValueFromCalldata(data, gnosis_safe_disable_module_offset))))`, where `_loadValueFromCalldata(data, gnosis_safe_disable_module_offset)` would be resolved to `_loadValueFromCalldata(data, 0x24)`.

https://github.com/re-nft/smart-contracts/blob/cbf5ff74e40576be72090afd99bf6f0c366bd315/src/policies/Guard.sol#L195-L293
```solidity
    function _checkTransaction(address from, address to, bytes memory data) private view {
        bytes4 selector;

        // Load in the function selector.
        assembly {
            selector := mload(add(data, 0x20))
        }

        ...
        } else if (selector == gnosis_safe_disable_module_selector) {
            // Load the extension address from calldata.
            address extension = address(
                uint160(
                    uint256(
                        _loadValueFromCalldata(data, gnosis_safe_disable_module_offset)
                    )
                )
            );

            // Check if the extension is whitelisted.
            _revertNonWhitelistedExtension(extension);
        ...
    }
```

https://github.com/re-nft/smart-contracts/blob/cbf5ff74e40576be72090afd99bf6f0c366bd315/src/libraries/RentalConstants.sol#L57-L62
```solidity
// bytes4(keccak256("disableModule(address,address)"));
bytes4 constant gnosis_safe_disable_module_selector = 0xe009cfde;

...
uint256 constant gnosis_safe_disable_module_offset = 0x24;
```

Because the `ModuleManager.disableModule` function below has two inputs, which are `prevModule` and `module`, executing `_loadValueFromCalldata(data, 0x24)` would return the `bytes32` representation of `prevModule`. This means that, in the `Guard