Draft: Refactor Ci::JobToken::Allowlist to prepare for inbound link changes

What does this MR do and why?

This MR adds Ci::JobToken::Allowlist#remove!, in the same style of #add! in !99166 (merged).

We're adding the ability to specify ProjectTokenScope direction in the RemoveProject mutation, and moving the logic for remove to Allowlist first will simplify the following GraphQL MR.

How to set up and validate locally

This is an internal refactor, so there's no reproduction of behavior to do from a Product perspective. Checking out the new added tests and confirming that everything else (removing outbound token scopes) still work is the validation to do of this change.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.