Audit unenroll should not set unenrolled_at attribute

[michel-laterman]

What is the problem this PR solves?

On systems where defend is running and may report as orphaned during an upgrade process, the unenrolled_at attribute will be set and will prevent future upgrade commands from being issued through Kibana.

How does this PR solve the problem?

Do not set the unenrolled_at attribute when the audit/unenroll API is called.
Remove the unenrolled_at attribute if it's set during checkin.

Design Checklist

• I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
• I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
• I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool

Related issues

• Relates Elastic-Agents unexpectedly unenrolled after update to 8.16.x elastic-agent#6213

[elastic-sonarqube]

Quality Gate failed

Failed conditions
E Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube

Catch issues before they fail your Quality Gate with our IDE extension SonarLint