Guarantee order of GetEnrollSecrets to prevent subtle bugs.

[getvictor]

Related issue: Resolves #36052

Checklist for submitter

Testing

• QA'd all new/changed functionality manually

[getvictor]

This test is currently failing on main: FAIL: TestMaintainedApps/UpsertMaintainedApps

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.33%. Comparing base (5303917) to head (bc145b1).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #36515      +/-   ##
==========================================
- Coverage   66.00%   59.33%   -6.68%     
==========================================
  Files        2134     2133       -1     
  Lines      181857   181905      +48     
  Branches     7428     7428              
==========================================
- Hits       120042   107935   -12107     
- Misses      50827    63904   +13077     
+ Partials    10988    10066     -922     

Flag	Coverage Δ
backend	59.97% <100.00%> (-7.62%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ksykulev]

subtle bugs indeed.
Confirmed, secret is the primary key

fleet/server/datastore/mysql/schema.sql

Line 405 in 56f01f0

PRIMARY KEY (`secret`),