value-pairs: Correctly exclude nv-pairs when they're in the base scope

When trying to decide whether a particular nvpair should be included in
the value-pairs set, we did not handle exclusions well: if the key was
in the default set, we included it anyway, regardless of exclusions.

With this patch, when the key is explicitly excluded or included, that
will be respected, regardless of whether it is in the default set or
not.

Also added a test case to trigger the original bug.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>