Require Agents to be enabled at group level before project level

This may need to be split into several issues, but let's align on this direction first.

After discussing with @abacon-gitlab @tvanderhelm @shekharpatnaik and @bastirehm , we concluded that Agents will need to follow the same enablement model as Flows. That is, they'll need to be enabled at the group level before they're enabled at the project level.

This will make the UX of enabling Flows and Agents consistent, and opens the door to using composite identity for agents should we need to do that in the future.