Make rollback, first upgrades and pin changes work as tested on Windows

Found in an end-to-end test on a Windows 11 VM against a self-signed server.

- Rollback: a 1.20 agent re-enrolls within a second of an un-enroll, so an
  older agent pushed afterwards arrived on an enrolled PC and was refused.
  Revoke now takes {"blockreenroll": true, "reason": ...}; a blocked PC is
  never issued a credential and keeps working on the shared key until
  POST .../assets/<assetid>/allow-reenroll. The Enrollment page offers the
  block when un-enrolling and shows blocked PCs with an allow button.
- First upgrade of old agents: agents before 1.20 check the server
  certificate when downloading the upgrade, so a store wave failed on PCs that
  do not trust a self-signed server while the Migration tab said ready. A
  failed download now marks the PC blocked with "server certificate not
  trusted by this PC". New Install-ShopDBServerCertificate.ps1 (GE-Enforce,
  SYSTEM) adds a non-CA server certificate to the trusted roots after checking
  its thumbprint; the server certificate page offers a .cer download and the
  SHA-1 thumbprint.
- The generated installer writes ServerPins (with an optional next pin for a
  planned rotation), can leave the shared key out so the PC waits for
  approval, never touches an existing credential, and skips the trusted-root
  import for a CA certificate.
- The agent re-reads server pins about every 60 seconds and recycles pooled
  connections within 2 minutes, so a pin change needs no restart.
- An alert can only be acknowledged by a PC it targets.
- A wave no longer counts a PC as failed after a later wave upgraded it.
- The scripts report a pin mismatch only when the pin really is missing, and
  otherwise log the real error.
- Runbook: trust step before the first wave, rollback order, pin re-read,
  verifying the pin against the live URL; agent contract updated.

tests/test_plugins/test_endpoints_credentials_migration.py

@@ -86,7 +86,8 @@ def _assert_head_schema(connection):
     credentialcolumns = {c['name'] for c in inspector.get_columns('endpointcredentials')}
     assert credentialcolumns == {
         'credentialid', 'assetid', 'credentialhash', 'credentialprefix',
-        'enrolledvia', 'issuedat', 'lastusedat', 'revokedat', 'revokedby'}
+        'enrolledvia', 'issuedat', 'lastusedat', 'revokedat', 'revokedby',
+        'reenrollblocked', 'reenrollblockedreason'}
     requestindexes = [tuple(ix['column_names']) for ix in
                       inspector.get_indexes('endpointenrollrequests')]
     assert requestindexes.count(('hostname', 'serialnumber')) == 1