CP Exclude Labels: apply exclusion logic when reconciling profiles/declarations

[mna]

#18849

Checklist for submitter

• [x] Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes. See Changes files for more information.
• [x] Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements)
• [ ] Added/updated tests