Fix giveOwnership() always-nil issue and nil dereference in removeOwned()

[joshuahannan]

• Capture `previousOwner` before calling `seal()` in `giveOwnership` — previously `getOwner()` was called after `seal()` set `currentlyOwned = false`, causing `previousOwner` to always be emitted as `nil` in the `OwnershipGranted` event
• Capture `uuid` before calling `seal()` in `Manager.removeOwned` — previously `uuid` was read after `seal()` could invalidate the capability, causing a force-unwrap panic on `id!` when the capability was invalid; replaced with an explicit panic message via `??`
• Restrict `parents`, `pendingOwner`, `acctOwner`, and `currentlyOwned` fields on `OwnedAccount` from `access(all)` to `access(self)` — public getter methods and interface conformances already provide all necessary read access
• Restrict `factories` field on `CapabilityFactory.Manager` from `access(all)` to `access(self)` — external callers use the `Getter` interface which already exposes `getFactory` and `getSupportedTypes`

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[jribbink]

nit: IMO this change is unnecessarily restrictive and prevents things like borrowing a reference to the dictionary/directly iterating values