Get device flags and scan schedule

Called by the MineOS device agent at the start of each scan; you do not call this endpoint yourself. It is
documented so that the traffic your devices generate is understood. The agent authenticates with the device
certificate issued at enrollment; there is no request body.

Responses:

• 200 — { "featureFlags": { "fleetKillSwitch": bool, ... }, "scanSchedule": { "version", "slotLocal", "windowStartLocal",
  "windowEndLocal" } }:
  the feature flags in effect for this device and the local time window in which it should scan
• 403 — no valid device certificate
• 503 — { "status": "degraded" }: the flags could not be evaluated right now; the agent falls back to its safe
  defaults