Direct-borrower path shares the same auction self-deal bug

Summary

The same auction self-deal root cause is separately reachable from TroveManager.open_trove()/borrow(): _transfer_borrow_tokens() calls the internal _redeem() with its default receiver = msg.sender whenever requested debt exceeds idle liquidity.

Root cause

Self-taking the auction lets the borrower extract real collateral for free on top of cash they were already legitimately owed - collateral value pulled from unrelated troves with no offsetting value entering anywhere.

Verification

Confirmed the root cause found on the Lender-withdrawal path is independently reachable through this second entry point, against real deployed contracts.

Verified against real, live deployed contract state.