Borrower can REVOKE A USER'S CREDENTIAL by Blocking the user instead of just preventing deposits, while the unblocking function if called will not return back the User's Revoked Role.
Audit: 2024-08-wildcat-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2024-08-wildcat/blob/fe746cc0fbedc4447a981a50e6ba4c95f98b9fe1/src/access/FixedTermLoanHooks.sol#L406
https://github.com/code-423n4/2024-08-wildcat/blob/fe746cc0fbedc4447a981a50e6ba4c95f98b9fe1/src/access/FixedTermLoanHooks.sol#L482-L491
https://github.com/code-423n4/2024-08-wildcat/blob/fe746cc0fbedc4447a981a50e6ba4c95f98b9fe1/src/access/FixedTermLoanHooks.sol#L493-L498
https://github.com/code-423n4/2024-08-wildcat/blob/fe746cc0fbedc4447a981a50e6ba4c95f98b9fe1/src/types/LenderStatus.sol#L55-L70


# Vulnerability details


## Proof of Concept

Only Registered providers should be able to approve and revoke users credentials but these act can be executed by the borrow while trying to prevent a user from depositing.
This issue is magnified because, This action of revoking the Users role when blocking is not returned when the user is unblocked hence a borrower can block then unblock a user but their roles have been revoked in this process and will not be available because the role are not not set again.

The former implemetation by wildcat is straight forward has the lender can add and remove lenders roles easily.

```solidity
  /**
   * @dev Grant authorization for a set of lenders.
   *
   *      Note: Only updates the internal set of approved lenders.
   *      Must call `updateLenderAuthorization` to apply changes
   *      to existing market accounts
   */
  function authorizeLenders(address[] memory lenders) external onlyBorrower {
    for (uint256 i = 0; i < lenders.length; i++) {
      address lender = lenders[i];
      if (_authorizedLenders.add(lender)) {
        emit LenderAuthorized(lender);
      }
    }
  }

  /**
   * @dev Revoke authorization for a set of lenders.
   *
   *      Note: Only updates the internal set of approved lenders.
   *      Must call `updateLenderAuthorization` to apply changes
   *      to existing market accounts
   */
  function deauthorizeLenders(address[] memory lenders) external onlyBorrower {
    for (uint256 i = 0; i < lenders.length; i++) {
      address lender = lenders[i];
      if (_authorizedLenders.remove(lender)) {
        emit LenderDeauthorized(lender);
      }
    }
  }
```

 But presently these roles have been delegated to Providers even if borrowers is also a provider, unblocking a user should return their credential if blocking a user unsets their credentials. 


```solidity
  function revokeRole(address account) external {
    LenderStatus memory status = _lenderStatus[account];
    if (status.lastProvider != msg.sender) {
      revert ProviderCanNotRevokeCredential();
    }
    status.unsetCredential();
    _lenderStatus[account] = status;
    emit AccountAccessRevoked(account);
  }

```

The vulnerability lies in how the system handles the blocking and unblocking of accounts:

1. **Blocking a User:**
   The borrower's ability to block a user also revokes their credentials and their access roles:


```solidity
   function blockFromDeposits(addres