Fix #21397 (#21535)

Adds InvokeContext::get_instruction_keyed_accounts() to skip first_instruction_account keyed_accounts in CPI.

programs/bpf_loader/src/syscalls.rs

@@ -2003,7 +2003,7 @@ where
     let demote_program_write_locks =
         invoke_context.is_feature_active(&demote_program_write_locks::id());
     let keyed_accounts = invoke_context
-        .get_keyed_accounts()
+        .get_instruction_keyed_accounts()
         .map_err(SyscallError::InstructionError)?;
     let mut account_indices = Vec::with_capacity(message.account_keys.len());
     let mut accounts = Vec::with_capacity(message.account_keys.len());