Add soft delete for revoked devices

Admins could only revoke devices, so never-enrolled and revoked
inventory rows piled up with no way to remove them. Soft-delete
is limited to REVOKED devices (revoke first), and ITAM GC now
hard-deletes PENDING/REVOKED orphans with no API key, postures,
or valid enrollment token—including user tombstones without
history.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/coredata/device_enrollment_token.go

@@ -24,6 +24,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"maps"
 	"time"
 
 	"github.com/jackc/pgx/v5"
@@ -167,3 +168,29 @@ WHERE
 
 	return nil
 }
+
+func (t *DeviceEnrollmentToken) DeleteByDeviceID(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+	deviceID gid.GID,
+) error {
+	q := `
+DELETE FROM device_enrollment_tokens
+WHERE
+    %s
+    AND device_id = @device_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"device_id": deviceID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete device_enrollment_tokens by device: %w", err)
+	}
+
+	return nil
+}