Add soft delete for revoked devices

Admins could only revoke devices, so never-enrolled and revoked
inventory rows piled up with no way to remove them. Soft-delete
is limited to REVOKED devices (revoke first), and ITAM GC now
hard-deletes PENDING/REVOKED orphans with no API key, postures,
or valid enrollment token—including user tombstones without
history.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/console/v1/graphql/device.graphql

@@ -237,6 +237,10 @@ type RevokeDevicePayload {
     device: Device!
 }
 
+type DeleteDevicePayload {
+    deletedDeviceId: ID!
+}
+
 type SetDeviceOwnerPayload {
     device: Device!
 }
@@ -254,6 +258,10 @@ input RevokeDeviceInput {
     deviceId: ID!
 }
 
+input DeleteDeviceInput {
+    deviceId: ID!
+}
+
 input SetDeviceOwnerInput {
     deviceId: ID!
     ownerId: ID
@@ -263,6 +271,7 @@ extend type Mutation {
     enrollDevice(input: EnrollDeviceInput!): CreateDevicePayload!
     createDevice(input: CreateDeviceInput!): CreateDevicePayload!
     revokeDevice(input: RevokeDeviceInput!): RevokeDevicePayload!
+    deleteDevice(input: DeleteDeviceInput!): DeleteDevicePayload!
     setDeviceOwner(
         input: SetDeviceOwnerInput!
     ): SetDeviceOwnerPayload!