Possible payment token theft - High Severity!

[olahfemi]

Description
Payment tokens can be stolen by an address by calling the payFee function when setFee is called again by an address that has the Dto.Roles.PRE_CERTIFICATE_TOKEN_MANAGER role. When setFee is called, an address that has claimed his tokens can call payFee to steal his initial payment. He might fail the first check in SLOC 94 but can pass the second check if the additionalTime has passed and the amount he paid is less than the new cohortFee.

Context
PreCertificateToken.sol SLOC81

Recommendation
We recommend that a check for sd.claimed be included in the second check. We also recommend the refund logic is moved to a separate function to make the logic intuitive for users and other developers and reduce possible errors.