feat: give the artifact-registry rig a gitlab-api service token

Prepares the rig for the service-token guard on /api/gitlab/v1 (gitlab-org/ops/artifact-registry#356 (closed)):

• values/artifact-registry.yaml and values/artifact-registry-iam.yaml: a rig-local dev token fixture (AR_GITLAB_API_SERVICE_TOKEN, mirroring AR_BOOTSTRAP_TOKEN) plus the auth.gitlab_api.service_token.env block, beside each file's existing auth arm.
• scripts/seed-ar-namespace.sh: sends the service-token header alongside the bootstrap bearer; each surface ignores the other's credential.

fragments/caproni.artifact-registry.yaml needs no change.

The monolith side does not send this token yet (tracked in gitlab-org/gitlab#617724), so the seed script is the rig's only caller of /api/gitlab/v1.