Disallow AI and Duo prefix usernames for new users

What does this MR do and why?

This MR prevents new users from creating usernames that start with reserved AI-related prefixes (duo-, duo_, ai-, ai_). This ensures these naming patterns remain available exclusively for GitLab AI entities and prevents potential confusion or impersonation.

Key changes:

• Adds validation to reject usernames starting with duo-, duo_, ai-, or ai_ (case-insensitive)
• Applies to both new user creation and username changes
• Existing users with these prefixes are grandfathered in and can continue using their usernames

References

Related to issue #581049 (closed)

How to set up and validate locally

1. Try creating a new user with username duo-test or ai-assistant - should fail with validation error
2. Try creating a user with username duotest or myai-bot - should succeed
3. For existing users with reserved prefixes, verify they can update other attributes but cannot change to another reserved prefix username

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.