[Rails] Use OpenBao Namespaces based on Cells Design

See new design for namespaces which has landed in the design document: https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/secret_manager/#tenant-definition

Here, we'll need to create an OpenBao namespace (https://openbao.org/api-docs/system/namespaces/#create-namespace) within the tenant (if not present -- it will succeed but return existing details) and project scope.

This simplifies cleanup as well: we can remove the namespace without removing related resources (auth/secret mounts) as namespace removal handles that automatically.

Namespaces cannot be removed if there are outstanding child namespaces, so this gives us an opportunity to ask for confirmation from an admin and then recursively offboard projects before removing the entire tenant.

Currently there is no namespace move functionality currently; per discussion we'll remove GitLab data after closed experiment and start fresh with this in closed beta.