remove artifact kind from PendingMgsUpdate

[davepacheco]

PendingMgsUpdate currently includes an ArtifactHashId, which is a combination of ArtifactKind and ArtifactHash. We need the hash, but we don't need the kind. This choice dates from the first iteration of PendingMgsUpdate, when the kind here specified which component was being updated. Now, that's specified by the details field, which has other component-specific information, too. So we don't need the kind and we can use an ArtifactHash directly rather than ArtifactHashId.

This is built on #8016 just to avoid conflicts.

Anticipating some related questions: we do still make other assumptions about some fields matching up. For example, the artifact referenced by this hash must be appropriate for the component being updated (SP vs. RoT vs. RoT bootloader), the board being updated (when it comes to the SP), the slot being updated (when it comes to RoT), the signing key (when it comes to RoT and RoT bootloader), etc. And updating to this artifact should result in version artifact_version being in the component's active slot. The executor checks / will double-check most of these. But it's the responsibility of the planner to set them correctly.

The way I think about all this is that the planner is responsible for taking the high-level, normalized data (like the policy "we should be running release 14" and the TUF repo metadata that specifies which artifact is appropriate for any given component) and creating a PendingMgsUpdate. That structure is essentially denormalized and gives the executor all the information it needs to complete the update without having to consult any other sources.