Fixing issues with Apple DDM profile status

[getvictor]

For #27979

This PR fixes Apple declarations issues:

• P2 issue with hashing the declaration token
• When declaration items are requested, mark any outstanding "remove" operations as pending. This prevents "remove" operations from being stuck in pending in some cases because they were actually already processed.
• When updating verification status, don't update "remove" operations -- we don't update their status and we just delete them. This prevents the issue where a "remove" operation got the updated status and the "install" operation got stuck in verifying forever.
• when adding a declaration that has a matching remove outstanding, mark the declaration verified. This prevents "install" operations from being stuck in pending/verifying. Why? Because there is nothing for the host to do if the same declaration was removed and then immediately added back.
• migration to delete "remove" operations with non-nil and non-pending status. These are the only legal statuses for remove operations.

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
• If database migrations are included, checked table schema to confirm autoupdate
• For database migrations:
  • Checked schema for all modified table for columns that will auto-update timestamps during migration.
  • Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
  • Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).
• Added/updated automated tests
• A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it)
• Manual QA for all new/changed functionality

[codecov]

Codecov Report

Attention: Patch coverage is 78.13953% with 47 lines in your changes missing coverage. Please review.

Project coverage is 64.25%. Comparing base (cb29a5d) to head (48163c8).
Report is 23 commits behind head on main.

Files with missing lines	Patch %	Lines
server/datastore/mysql/apple_mdm.go	75.96%	20 Missing and 11 partials ⚠️
...es/20250513162912_HostMDMAppleDeclarationsToken.go	60.00%	6 Missing and 2 partials ⚠️
server/service/apple_mdm.go	87.87%	5 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #29059      +/-   ##
==========================================
+ Coverage   64.22%   64.25%   +0.02%     
==========================================
  Files        1829     1830       +1     
  Lines      177537   177747     +210     
  Branches     5165     5165              
==========================================
+ Hits       114020   114203     +183     
- Misses      54569    54586      +17     
- Partials     8948     8958      +10     

Flag	Coverage Δ
backend	65.23% <78.13%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.