Amend ADR-020 and ADR-021: LookupResources is on the auth path

The Artifact Registry drains IAM's LookupResources per request to bound repository-list visibility by the caller's own grants, under the forwarded end-user JWT. Three sentences across two ADRs said otherwise.

ADR-020, flow split. LookupResources was listed with the admin and UI RPCs called by the Rails GraphQL wrapper under its own scoped token. It moves to the data path beside ReadRelationships, with the condition IAM enforces on it; the other five stay with the wrapper.

ADR-021, Grant-bounded repository-list evaluation. Said the endpoint was not expected in time for the .com closed beta, so adoption was deferred. gitlab#626615 closed and the endpoint shipped, so adoption is happening. Points at S09's Repository listing section for the mechanism rather than restating it.

ADR-021, open question 5. The adoption narrows the repository-list scan question rather than retiring it: where the caller holds no grant on the namespace or its organization ancestor the question no longer applies, and where they do the namespace-sized walk still runs, so it stands there. Also records that the bound on the first arm is the caller's grant count across the IAM instance, since the lookup takes no namespace scope.

Both ADRs read as authoritative on either side of the Artifact Registry step MRs landing.

Related to https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/969