modify megolm's prepareToEncrypt to be cancellable

[uhoreg]

prepareToEncrypt is introduced in #1252 so that applications can pre-send keys to recipients before the message itself is ready to send, reducing the amount of work that needs to be done when the message is sent.

However, the current function cannot be cancelled if the key cannot be used after all (e.g. a user/device has left, so the key needs to be rotated).

[clarkf]

I believe this is the root cause of element-hq/element-web#21612. Or, well, sorta. Mind if I take a stab at it?

MegolmEncryption#prepareToEncrypt does a bunch of expensive, blocking crypto on the main thread per untrusted device (see CrossSigningInfo#checkDeviceTrust). I don't think a simple cancellation callback will work, since it mostly blocks the caller.

The most straightforward option would be to break the work up into chunks, wrapped in setImmediate (or similar). Allow preemption between each checkDeviceTrust call. Then, cancellation could be added, and element-hq/element-web#21612 resolved (probably).

The "correct" solution would probably be to move the expensive crypto off the main thread, using a WebWorker or something. I don't think that's super reasonable, though, and would require some really sweeping changes.