Restore pending key rotations on re-syncs

[corrideat]

Problem

From #33 (comment)

There still is one race condition that needs to be handled. The situation is more or less as follows:

Setup:

A contract with a foreign key that's out of sync (but that has been rotated at least once) and syncing from scratch.

Race condition:

1. Chelonia notices that the key needs to be rotated as pendingKeyRotations is set
2. Chelonia notices that the key has been updated and clears pendingKeyRotations. This step may be wrong if the key still is out of sync (it could have been updated, just not to the latest).

Solution

pendingKeyRotations should not be cleared if the key still is out of sync. Alternatively, pendingKeyRotations can be cleared, but it must be set again.

(pendingKeyRotations is a dictionary; set and clear truly mean the corresponding key in the dictionary)

[corrideat]

Additional context:

In terms of impact, it means that if a contract is being synced from scratch it may not update foreign keys that need to be rotated the way one would expect. In other words, keys that already are out of sync will continue to be out of sync after syncing from scratch.

This shouldn't break things (and if it does, that's another bug), but it's a mistake because we're relying on keys that the authoritative source (the owner contract) no longer recognises as valid.

A concrete example: someone leaves a group (causing a key rotation) and the #general chatroom for some reason doesn't reflect this rotation, meaning the former member can still read and sign messages. Syncing from scratch may not fix this situation (which is surprising / unexpected).