SSVL: post-story cleanup

[mna]

• ✔️ @mna: Use API or Datastore method in integration tests
  • https://github.com/fleetdm/fleet/pull/24644/files/07c06a922c8b262bb427e3c71e2fabbf10835e2d#diff-bbd0c5a6bc2f9a24e633031d4c6a3f5b0be7cbfe78ef1b56cdf9a7a2c32e21e2R15561

• draft PR: SSVL: add timestamp-based check for the exclude-any case #24889 handle dynamic queries ("exclude any" condition is always true by default before hosts report results for the query - IMPORTANT likely a release blocker): feat: filter host software by label scoping #24801 (comment)
  • For configuration profiles we implemented a "simple" timestamp-based fix for that as it was for a reported bugfix, but I also suggested a more robust approach, TBD which approach we want to use for installers: Scoping config profile deployment with label exclusions is flakey #22162 (comment)
• ✔️ @mna: Fix setting of labels in the EditedSoftware activity, it currently always uses the old (pre-update) ones

Automated test updates

• Update the tests added here to check things like the IDs returned: feat: filter host software by label scoping #24801 (comment) @jahzielv fixed here
• Integration test that checks label scoping for the install software endpoints @jahzielv fixed here
• Integration test that checks policy automation software label scoping @jahzielv

[fleet-release]

Tests refined and fixed,
Fleet's truth clearer, un-mixed,
Security uplifted.

Queries dynamic, adapt,
Like wind through a cloud city,
Data gaps are trapped.

Old labels no more used,
In a digital springtime,
Freshness is infused.