activitypub: fetch_object_from_id(): prefer `actor` over `attributedTo` to avoid spoofing

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -747,7 +747,7 @@ def fetch_object_from_id(id) do
              "type" => "Create",
              "to" => data["to"],
              "cc" => data["cc"],
-             "actor" => data["attributedTo"],
+             "actor" => data["actor"] || data["attributedTo"],
              "object" => data
            },
            :ok <- Transmogrifier.contain_origin(id, params),