deal with the distinction between CredRandomWithUv and CredRandomWithoutUv to avoid losing access to vaults when authenticator PIN is added

[glyph]

Per this comment:

keepassxreboot/keepassxc#9506 (reply in thread)

The user's hmac-secret key may change if the user adds or removes a PIN from the device. I think that tokenring currently does not take this into account, which could hypothetically result in a user creating a token vault, adding a PIN to their authenticator, then losing irreversibly losing access to that vault.