Add restricted access check for SAML on Gitlab.com

This is part of #572853+.

What does this MR do and why?

This MR adds Block Seat Overages (BSO) aka Restricted Access support to SAML group membership provisioning on GitLab.com. When BSO is enabled and adding a user would consume new seats beyond the subscription limit, the system automatically assigns MINIMAL_ACCESS instead of the configured access level.

The implementation uses the previously introduced SeatAwareProvisioning mixin and applies to both:

• SystemAccess::BaseSaaSGroupSyncWorker - for SAML group sync operations
• Gitlab::Auth::GroupSaml::MembershipUpdater - for default membership during SAML SSO

When BSO restrictions are applied, the system logs the access level adjustment. The feature is protected by the bso_minimal_access_fallback feature flag which is currently disabled.

References

• #572853+
• https://gitlab.com/groups/gitlab-org/-/epics/19428+

Screenshots or screen recordings

N/A

How to set up and validate locally

1. Enable the feature flag: Feature.enable(:bso_minimal_access_fallback, group.root_ancestor)
2. Configure BSO settings: group.namespace_settings.update!(seat_control: :block_overages)
3. Set up SAML provider with group links or default membership
4. Ensure your test environment simulates no available seats
5. Trigger SAML SSO or group sync that would exceed seat limits
6. Verify users are added with MINIMAL_ACCESS instead of the configured level
7. Check application logs for BSO adjustment messages

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.