fix: backport multisig delegation fixes from main

[kentbull]

This backports the multisig delegation fixes from main to 1.2.7 and adds one new fix described by the below diagram to, from within the manually-triggered delegables escrow processing, walk the KEL to find a delegation approval seal so that Kevery.processEvent can be called with the seal data in order to allow validation to proceed to Kever.logEvent, which eventually puts the seal in the AES database.

Diagram

┌─────────────────────────────────────────────────────────────────┐
│ 1. DIP arrives at delegator (no seal attached)                  │
│    → escrowed to delegables                                     │
│    → AES is NOT set (logEvent never called)                     │
├─────────────────────────────────────────────────────────────────┤
│ 2. Delegator approves (creates anchor IXN)                      │
│    → Seal {i: delegate_pre, s: 0, d: dip_said} in delegator KEL │
│    → AES for DIP is STILL empty                                 │
├─────────────────────────────────────────────────────────────────┤
│ 3. processEscrowDelegables runs                                 │
│    → getAes(dgkey) returns None (empty!)                        │
│                                                                 │
│    WITHOUT KEL lookup (old code):                               │
│      → seqner=None, saider=None                                 │
│      → processEvent called with no seal                         │
│      → valSigsWigsDel re-escrows to delegables                  │
│      → INFINITE LOOP - test hangs                               │
│                                                                 │
│    WITH KEL lookup (new code):                                  │
│      → fetchLastSealingEventByEventSeal finds seal in KEL       │
│      → seqner, saider populated from KEL                        │
│      → processEvent succeeds                                    │
│      → logEvent called → AES finally set                        │
│      → Event removed from escrow ✓                              │
└─────────────────────────────────────────────────────────────────┘

Tests

Once this PR is merged then I will retarget kentbull#9 to v1.2.7 so we can have integration tests that test these backported fixes.

[kentbull]

The tests that depend on this PR are in kentbull#9

Once this PR is merged then I will re-target the above PR to WebOfTrust/keripy branch v1.2.7