Scope device enrollment token deletes

Delete and DeleteExpired omitted Scoper, breaking the
tenant-isolation pattern used elsewhere in coredata. Pass a
tenant scope from ExchangeEnrollmentToken and NewNoScope from
the ITAM GC so cross-tenant cleanup stays explicit.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/itam/gc.go

@@ -95,7 +95,7 @@ func (h *gcHandler) cleanup(ctx context.Context) error {
 		func(ctx context.Context, tx pg.Tx) error {
 			var token coredata.DeviceEnrollmentToken
 
-			tokensDeleted, err := token.DeleteExpired(ctx, tx, now)
+			tokensDeleted, err := token.DeleteExpired(ctx, tx, coredata.NewNoScope(), now)
 			if err != nil {
 				return fmt.Errorf("cannot delete expired device enrollment tokens: %w", err)
 			}