Store per-tenant flags separately from other flags

[RebeccaMahany]

Some agent flags are applicable to a device regardless of which tenant it's under -- for example, a device can only ever have one pinned launcher version, not multiple.

Other flags, however, can have multiple valid values for a multitenant launcher installation. For example, the osquery and osquery watchdog flags can differ per-tenant since we will run a different osquery instance per tenant.

Flags that are per-tenant rather than global should be stored as such.

This change must be backwards compatible.