Keep every server pin in the upgrade script, and stop promising enrollment to an enrolled PC

Found in the Windows VM check.

- The agent upgrade script wrapped Get-ShopDbServerPins in @(), which turned
  several registry pins into one joined string. During a certificate rotation
  the upgrade download would have refused the rotated server. It also merged
  appsettings pins with the registry; it now follows the agent's rule: when the
  ServerPins value exists, even empty, the registry owns the list. The shared
  pin block in the upgrade script and both reporters gains
  Test-ShopDbServerPinsValue.
- A key-less package installed over an enrolled PC printed both "existing
  enrolled credential found; kept as is" and "This PC will request
  enrollment". The enrollment notices now print only when no credential exists.

plugins/computers/client/Report-AssetToShopDB.ps1

@@ -205,6 +205,26 @@ function Get-ShopDbServerPins {
     return ,$pins
 }
 
+function Test-ShopDbServerPinsValue {
+    # True when ServerPins exists in either registry view, even empty. The
+    # registry then owns the pin list and appsettings pins are ignored, the
+    # same rule the agent follows.
+    foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64, [Microsoft.Win32.RegistryView]::Registry32)) {
+        try {
+            $base = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $view)
+            try {
+                $key = $base.OpenSubKey('SOFTWARE\GE\ShopDB')
+                if ($key) {
+                    try {
+                        if ($key.GetValueNames() -contains 'ServerPins') { return $true }
+                    } finally { $key.Dispose() }
+                }
+            } finally { $base.Dispose() }
+        } catch {}
+    }
+    return $false
+}
+
 function Enable-ShopDbServerPins([string[]]$Pins) {
     # True when pinning is active. False means pins are set but could not be
     # enforced; the caller must not send anything then.