MEDIUM severity: `IncentiveVoting::unfreeze` doesn't remove votes if a user has voted with unfrozen weight prior to freezing. **Description:** `IncentiveVoting::unfreeze` doesn't remove votes if a user has voted with unfrozen weight prior to freezing.

**Impact:** Users keep their past votes unexpectedly after unfreezing their locks with `keepIncentivesVote = false`.

**Proof of Concept:** Add the PoC function to...

Vulnerable code:
function test_unfreeze_failToRemoveActiveVotes() external {
    // setup vault giving user1 half supply to lock for voting power
    _vaultSetupAndLockTokens(INIT_BAB_TKN_TOTAL_SUPPLY/2);

    // verify user1 has 1 unfrozen lock
    (ITokenLocker.LockData[] memory activeLockData, uint256 frozenAmount)
        = tokenLocker.getAccountActiveLocks(users.user1, 0);
    assertEq(activeLockData.length, 1); // 1 active lock
    assertEq(frozenAmount, 0); // 0 frozen amount
    assertEq(activeLockData[0].amount, 2147483647);
    assertEq(activeLockData[0].weeksToUnlock, 52);

    // register receiver
    uint256 RECEIVER_ID = _vaultRegisterReceiver(address(mockEmissionReceiver), 1);

    // user1 votes for receiver
    IIncentiveVoting.Vote[] memory votes = new IIncentiveVoting.Vote[](1);
    votes[0].id = RECEIVER_ID;
    votes[0].points = incentiveVoting.MAX_POINTS();

    vm.prank(users.user1);
    incentiveVoting.registerAccountWeightAndVote(users.user1, 52, votes);

    // verify user1 has 1 active vote
    votes = incentiveVoting.getAccountCurrentVotes(users.user1);
    assertEq(votes.length, 1);
    assertEq(votes[0].id, RECEIVER_ID);
    assertEq(votes[0].points, 10_000);

    // user1 freezes their lock
    vm.prank(users.user1);
    tokenLocker.freeze();

    // verify user1 has 1 frozen lock
    (activeLockData, frozenAmount) = tokenLocker.getAccountActiveLocks(users.user1, 0);
    assertEq(activeLockData.length, 0); // 0 active lock
    assertGt(frozenAmount, 0); // positive frozen amount

    // user1 unfreezes without keeping their past votes
    vm.prank(users.user1);
    tokenLocker.unfreeze(false); // keepIncentivesVote = false

    // BUT user1 still has 1 active vote which is not an intended design
    votes = incentiveVoting.getAccountCurrentVotes(users.user1);
    assertEq(votes.length, 1);
    assertEq(votes[0].id, RECEIVER_ID);
    assertEq(votes[0].points, 10_000);
}

function unfreeze(address account, bool keepVote) external returns (bool success) {
        // only tokenLocker can call this function
        require(msg.sender == address(tokenLocker));

        // get storage reference to account's lock data
        AccountData storage accountData = accountLockData[account];

        // cache account's frozen weight
        uint256 frozenWeight = accountData.frozenWeight;

-        // if frozenWeight == 0, the account was not registered so nothing needed
        if (frozenWeight > 0) {
            // same as before
        }
+       else if (!keepVote) {
+            // clear previous votes
+            if (accountData.voteLength > 0) {
+                _removeVoteWeights(account, getAccountCurrentVotes(account), 0);
+
+                accountData.voteLength = 0;
+                accountData.points = 0;
+
+                emit ClearedVotes(account, week);
+            }
+        }

        success = true;
    }