Fix setRecoverySecretTypes to not always set snapshot pending

Only updates should set snapshot pending. Setting the secret types for
the first time should not set snapshot pending. If it did, then just
initializing the recovery agent would cause a snapshot to be made, even
if it contained no keys. Also, setting the secret types to the same value
as it was previously should not set snapshot pending, for the exact same
reason. If the secret types were to change, however, for some reason,
then a new snapshot must be made, as it may have additional or fewer
layers of protection.

Bug: 74949975
Test: runtest frameworks-services -p \
      com.android.server.locksettings.recoverablekeystore

Change-Id: Ib29d56d5c46e730d9ed457f2d516f84ecb9e53b8