Add soft delete for revoked devices

Admins could only revoke devices, so never-enrolled and revoked
inventory rows piled up with no way to remove them. Soft-delete
is limited to REVOKED devices (revoke first), and ITAM GC now
hard-deletes PENDING/REVOKED orphans with no API key, postures,
or valid enrollment token—including user tombstones without
history.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/itam/gc.go

@@ -100,10 +100,18 @@ func (h *gcHandler) cleanup(ctx context.Context) error {
 				return fmt.Errorf("cannot delete expired device enrollment tokens: %w", err)
 			}
 
+			var device coredata.Device
+
+			devicesDeleted, err := device.DeleteOrphans(ctx, tx, now)
+			if err != nil {
+				return fmt.Errorf("cannot delete orphan devices: %w", err)
+			}
+
 			h.logger.InfoCtx(
 				ctx,
 				"itam garbage collector cleaned up",
 				log.Int64("device_enrollment_tokens_deleted", tokensDeleted),
+				log.Int64("orphan_devices_deleted", devicesDeleted),
 			)
 
 			return nil