Preserve repeated keys in INI store

[gochist]

Summary

• Preserve repeated INI keys when parsing and encoding SOPS trees.
• Add a regression test covering duplicate and identical repeated keys through an encrypt/decrypt-style round trip.

Fixes #2314

Tests

• go test ./stores/... — passed.
• go vet ./stores/ini — passed.
• go test -race -coverprofile=profile.out -covermode=atomic ./... — passed.

[ToniAdreal]

Independently verified the fix against the reported case: on current main the round trip collapses the three driver lines to one; with this PR all three survive, including the identical duplicate.

Two smaller things I noticed while testing:

1. If a comment sits directly before the last occurrence of a repeated key, it ends up in the tree once per value. Repro: [sec] with driver = a, then ; note mid, then driver = b — parsing produces [driver a, Comment("note mid"), driver b, Comment("note mid")], because the key.Comment append runs inside the ValueWithShadows() loop. Hoisting that append out of the loop (once per key) fixes it. The re-encoded INI happens to render the comment once, but the duplicate is in the tree itself.
2. Interleaved repeats get regrouped: driver = a / other = 1 / driver = b round-trips as driver = a / driver = b / other = 1. All values are preserved; only the cross-key ordering changes (this follows from section.Keys() yielding each key once with its shadows grouped). Flagging it in case strict order preservation matters for the OpenStack use case in INI encryption silently drops repeated keys within a section #2314.

[gochist]

Thanks for the review. I moved the key.Comment append outside the ValueWithShadows() loop so each repeated key's comment is added to the SOPS tree only once, and added a regression test for the reported case.

For the ordering point, I checked oslo.config, OpenStack's configuration library. It looks up options by name, so it does not depend on the order of different keys; the regrouping of interleaved repeated keys does not affect that use case.

I ran go test ./... and go vet ./stores/ini locally in a container; both passed.