Support creating one token on Paid Trials

What does this MR do and why?

Relate Issue: #386041 (closed)

Environment: ~SaaS

Previously, Paid Trials were not allowed to create project tokens in SaaS environment. Creation is now allowed and limited to one.

In the past, GitLab used policy create_resource_access_tokens to prevent the trial license to create project tokens and group tokens. Now, we let go of project policy create_resource_access_tokens's inspection of the trial license, and put the verification logic in the token models.

Screenshots or screen recordings

When using Paid Trials

Before	After	After(When token already exists)

How to set up and validate locally

Test locally with gdk

1. Change the code to pretend to have Plan limits

   diff --git a/ee/app/models/ee/group.rb b/ee/app/models/ee/group.rb
   index b0a1e3fe2fb7..a4b867fe050e 100644
   --- a/ee/app/models/ee/group.rb
   +++ b/ee/app/models/ee/group.rb
   @@ -799,6 +799,7 @@ def active_project_access_tokens_with_descendants
   
       override :reached_project_access_token_limit?
       def reached_project_access_token_limit?
   +      return root_ancestor.active_project_access_tokens_with_descendants.count >= 1
         actual_limits.exceeded?(:project_access_token_limit, root_ancestor.active_project_access_tokens_with_descendants)
       end

2. Start gdk, and specify the operation mode as SaaS

   $ export GITLAB_SIMULATE_SAAS=1
   $ gdk start

3. Visit the project access tokens page: http://127.0.0.1:3000/flightjs/Flight/-/settings/access_tokens

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

---

cc @mtan-gitlab @icbd