Implement Namespaces::StatePropagationIterator subclass

Summary

Create a subclass of Gitlab::Database::NamespaceEachBatch that adds state-aware filtering to the tree iterator's DFS traversal, enabling propagation boundary enforcement.

Tasks

• Create app/models/namespaces/state_propagation_iterator.rb subclassing Gitlab::Database::NamespaceEachBatch
• Accept a state_filter parameter (array of overwritable state values)
• Override walk_down to add AND state IN (overwritable_states) to the LATERAL subquery that finds the first child
• Override next_elements to add the same state filter to the LATERAL subquery that finds the next sibling
• Ensure the DFS skips namespaces with states not in the filter, pruning their entire subtrees
• Verify the iterator still works correctly with cursor-based batching and the of: batch size parameter

References

• ADR 003 — Boundary enforcement
• Gitlab::Database::NamespaceEachBatch
• Parent epic: &21921 (closed)