Add BSO check for self-managed SCIM

This is part of #513219+.

Depends on Add foundation module for BSO seat check (!201940 - merged).

What does this MR do and why?

This MR adds Block Seat Overages (BSO) support to instance-level SCIM group membership provisioning. When BSO is enabled and adding a user would consume new seats beyond the subscription limit, the system automatically assigns MINIMAL_ACCESS instead of the configured access level.

The implementation integrates with the BSO foundation module through the SeatAwareProvisioning mixin and only applies restrictions when operations would actually consume new seats. This prevents subscription overages while maintaining user access to groups.

When BSO restrictions are applied, the system logs the access level adjustment. The feature is protected by the bso_minimal_access_fallback feature flag which is currently disabled.

References

• #513219+

Screenshots or screen recordings

N/A

How to set up and validate locally

1. Enable the feature flag: Feature.enable(:bso_minimal_access_fallback)
2. Configure BSO settings to limit available seats in your test environment
3. Make sure your instance is out of seats (e.g. upload a license with very few seats)
4. Create SCIM group links with access levels above MINIMAL_ACCESS (e.g., DEVELOPER)
5. Trigger SCIM user provisioning that would exceed the configured seat limits
6. Verify that users are added with MINIMAL_ACCESS instead of the originally configured level
7. Check the application logs for BSO adjustment messages containing details about the downgrade

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.