[DBSC] Do not bind a refresh token before other tokens loaded

There is a small number of clients that have refresh tokens bound to
different binding keys, even though DiceResponseHandler ensures that the
the key will be reused if it exists.

One hypothesis about how this might be happening is that
`GetWrappedBindingKeyToReuse()` chooses a binding key before all refresh
tokens are loaded from disk. This is quite unlikely as this would mean
that the user managed to complete a sign-in before a database disk read
completes on startup.

That's why this CL simply refuses to bind a token if such a situation
ever occurs. "Signin.DiceTokenBindingOutcome" histogram will tell us
whether the new code path gets ever triggered.

Bug: 428138073
Change-Id: I043c0406dd0f7548585e65ac8d8143768971f560
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6683718
Reviewed-by: Boris Sazonov <bsazonov@chromium.org>
Commit-Queue: Alex Ilin <alexilin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1480919}