When you do Kerberos Constrained Delegation (or anything pre-Resource-Based Delegation) on Windows, you assign delegation rights to the identity of the process accepting the kerberos tickets from the inbound hop.
So in short, if the process is running as a domain user, that user needs delegation enabled. If it's running as a System-type identity, the computer does. But you should always Constrain delegation, or use the newer Resource-Based Delegation model (where instead of identifying back-end SPNs, you identify front-end Identities allowed to delegate to the target service identity from the target service identity).
Unconstrained delegation is a bad idea - it might best be considered a stopgap solution in Windows 2000 which gained constraints quickly in Windows Server 2003. It allows impersonation of any qualifying service principal (read: User or computer) to another service, with no restrictions. Get someone's ticket, do anything they can do - so control of a service set with unconstrained delegation meant control of any connecting user.
For IIS Web Applications, that generally means the App Pool Account - the base (non-client-impersonating) identity of the w3wp.exe processes associated with that App Pool. If the app pool is running as LocalSystem (don't do that), Local Service, Network Service or ApplicationPoolIdentity, then the identity used for decoding Kerb tickets and delegation is the computer account. (Couple of other caveats there like UseAppPoolCredential=true or UseKernelMode=false might also cause a non-custom user identity to be used to try to decode a ticket, but that's out of scope.)
Any Security Principal can be assigned delegation rights. Giving any User object a Service Principal Name (SPN - use SetSPN.exe), which computers have by default (HOST/computername) will enable the Delegation tab in DSA.msc.
One exception to the above is Group Managed Service Accounts (gMSAs), which should be your first choice for any new service which uses a Domain identity to run a service, as it self-manages its complex password, preventing easy long-term-password attacks on the account itself.