Malicious delegators can get more rewards than they should

Summary

The RemoveDelegateStake and AddDelegateStake actions in the emissions module don't update the delegatedStakePlacement.RewardDebt to record the claimed reward after sending the pending reward to the delegators.

Vulnerability Detail

When delegators remove their stake, emissions keeper#RemoveDelegateStake calculate their pending reward then send the rewards to the delegators:

func (k *Keeper) RemoveDelegateStake(
    ...
    pendingReward, err = pendingReward.Sub(delegatedStakePlacement.RewardDebt)
    if err != nil {
        return err
    }
    if pendingReward.Gt(alloraMath.NewDecFromInt64(0)) {
        err = k.SendCoinsFromModuleToAccount(
            ctx,
            types.AlloraPendingRewardForDelegatorAccountName,
            delegator,
            sdk.NewCoins(sdk.NewCoin(params.DefaultBondDenom, pendingReward.SdkIntTrim())),
        )
        if err != nil {
            return errorsmod.Wrapf(err, "Sending pending reward to delegator failed")
        }
    }
    ....
}

However, the function don't update the delegatedStakePlacement.RewardDebt to record the claimed reward after sending the pending reward. This means that the delegators can claim the reward multiple times by removing their stake multiple times with little msg.amount every time.

Same issue also exists in AddDelegateStake action.