Tapioca: User Can Claim More Than totalAmount Due to Lack of Max Return Amount Check in _vested Function

Tapioca's Vesting contract has an accounting defect in its `_vested` function: the initial-unlock time offset is subtracted from the vesting start before computing the linearly vested amount, and the partial-vesting branch is never clamped to the total allocat …