Override transfer behavior and enforce sender has TRANSFER_ROLE

[ilikesymmetry]

Read more context here

[linear]

ADS-1326 Change BuilderCodes transferability rules

Per insight from nick.prince, it would be preferable to Base Build if Builder Codes were default non-transferable. This would help mitigate risks on compliance, engineering, and secondary markets/farming.

However, there are still cases where transferability is desired. As a middle ground, the proposed mechanism is to introduce a new role, TRANSFER_AGENT_ROLE, which are the only entities allowed to initiate transfers. The _transfer function would be overridden to enforce that transfer/safeTransfer/transferFrom/safeTransferFrom all can only be called by a Transfer Agent. This can be done with a 1 line addition of _checkRole(TRANSFER_AGENT_ROLE, msg.sender).

This new role would NOT be able to unilaterally take assets from BuilderCode owners. Code owners would have to give approvals to Transfer Agents (most likely smart contracts) and then execute through them (enforcing any custom logic we need) to move their token. Things like transferring from a personal EOA to a team Safe would be an exception we would want some ability to offer.

Importantly, this middle ground would NOT require us to upgrade BuilderCodes to enable custom transfer logic. This gives us a safer/easier path to customizing transfer rules over time. Eventually we may consider a hard upgrade to BuilderCodes once we identify a clear and stable transferability ruleset.

[ilikesymmetry]

Example of how we can add transferability rules modularly with new smart contracts.