fix(plugins): install rejected plugins one at a time

[datlechin]

Why

Review of #3519: a connection could start installing a rejected plugin before the update pass got its manifest. The pass then tried the same plugin, reserveInstall threw "Another install is already in progress", and the pass logged an error and spent a retry. The connection path also ran in no test, since SoftwareUpdater.isUpdatingEnabled is false in Debug.

Change

• The pass and a connection take one gate to install rejected plugins, and recheck their targets once they hold it, so neither installs a plugin the other just repaired.
• The pass takes the gate only after its manifest arrives, and drops it before staging loaded plugins.
• PluginManager takes isUpdatingEnabled in its init, defaulting to SoftwareUpdater.isUpdatingEnabled.

Verified

passWaitsForAConnectionsRepair() fails when the pass skips the gate; the log shows "Another install is already in progress". connectionRepairsWhileThePassWaitsForTheNetwork() replaces the test that called RegistryClient directly, and drives prepareForConnecting.