NEO contract violates security constraints (a bit)

[roman-khimov]

Describe the bug
We've added some events to NEO contract in #2754, but RequiredCallFlags of the respective methods (registerCandidate/unregisterCandidate, vote) remained the same. So these methods require States only, while in fact they emit notifications now and thus technically require AllowNotify.

Practically it's not a big problem, not a lot of people complaining, but still it's a violation of security constraints provided by call flags.

To Reproduce
Call any of the methods above with States call flags, get an event for free.

Expected behavior
Failure in a case of such call.

Additional context
While it's rather easy to fix with three lines changed, I fear we'd get something similar to #2673 and this behavior change can be probed by transactions, so it needs a hardfork. But can we actually change call flags with a hardfork? We can add/delete methods, but it looks like this case is somewhat different and can not be easily expressed currently, so some change to the hardfork mechanism is required in fact.

[shargon]

But can we actually change call flags with a hardfork?

Currently not, I will try to find the way

[AnnaShaleva]

A nice catch.