Replace methods that check for AddOnPurchases

Problem

We are migrating away from AvailableServices in Cloud Connector. This means we need to move the purchased? and add_on_purchases methods elsewhere, away from this API.

These methods determine whether a "service" has been "purchased" (this translates to: are the UPs under this service bundled with an add-on that is active for the namespace/instance).

• Used primarily in UI access control checks (Code Suggestions, Anthropic Proxy, X-Ray, settings API).
• If we replace this with groupprovision APIs, then it depends on Phase 4 since we'd have to replace the service name with a UP name.

Approach

My suggestion is to:

• Introduce a scope on AddOnPurchase that is a 1-1 copy of service.add_on_purchases and rewrite service.add_on_purchases by delegating to this new scope instead. MR: !191493 (merged)
• Remove service.add_on_purchases and the FF by the new scope (MR: !192366 (merged))
• Replace all calls to service.purchased?:
  • EE::Group: Used to guard allow_update_enable_auto_assign_gitlab_duo_pro_seats?, which was never rolled out. Only relevant for gitlab.com. We may want to just remove the code that uses it entirely. MR: !194831 (merged)
  • Application setting disabled_direct_code_suggestions, introduced in !156147 (merged). MR: !193730 (merged)
    • ApplicationSettingsController: Not namespace-specific. Guards the Enable Direct Access toggle, which is used in a number of places.
    • API::Settings: This is the API code path corresponding to the ApplicationSetting from item 1.
    • API::Entities::ApplicationSetting: This is the API resource that renders this field.
  • ProjectSettingsUpdate: A GraphQL mutation that controls Duo settings. Introduced in !143972 (merged). Currently always enabled on .com. This should eventually be replaced with a "can update project settings" check instead see this comment. MR: !194473 (merged)
  • ApplicationSettingsHelper: Used twice, first for duo_pro_visible flag, which appears unused? Asked here. Second for experiments_settings_allowed? which also appears unused. MR: !194831 (merged)
  • Xray: We can safely remove this; this is unused anyway. MR: !195311 (merged)
• Remove purchased? implementation and docs. MR: !195753 (merged)