Foundational flows cascading does not work for projects within Subgroups

What does this MR do and why?

This MR fixes the cascading of Foundational Flows to projects within subgroups.

This MR also removes the ability to select foundational flows in a subgroup as foundational flows live within the top-level group due to service accounts.

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

Self-managed testing

1. Run GDK in self-managed mode, and in a Duo enabled group (ensure it has a subgroup with a project) open the settings e.g. http://gdk.test:3000/groups/gitlab-duo/-/edit
2. Scroll down to "GitLab Duo features" and expand it, notice "Allow foundational flows" and a selection of flows

3. Select one of the flows and click on "Save changes"
4. In the same group, click on "Automate > Flows" and observe the Flow you selected is part of the list of flows

5. Go to the Flows page in one of the projects of the groups e.g. http://gdk.test:3000/gitlab-duo/test/-/automate/flows
6. Observe that the same flow is present.

7. Go to a project in the subgroup of the group e.g. http://gdk.test:3000/gitlab-duo/duo-subgroup/duo-subgroup-project/-/automate/flows
8. Verify the project in the subgroups has the flows enabled

9. Go back to the group settings and disable the flow, click save changes. Verify in the Flow menu of the group and project that the Flow has been removed.

SaaS testing

1. Run GDK in SaaS mode. The testing is almost the same but SaaS has top-level group / namespace admin settings.
2. In a Duo enabled group (ensure it has a subgroup with a project) open the settings e.g. http://gdk.test:3000/groups/gitlab-duo/-/settings/gitlab_duo
3. Click on "Chance configuration" and scroll down to "Flow execution"

4. Select one of the flows and click on "Save changes"
5. In the same group, click on "Automate > Flows" and observe the Flow you selected is part of the list of flows

6. Go to the Flows page in one of the projects of the groups e.g. http://gdk.test:3000/gitlab-duo/test/-/automate/flows
7. Observe that the same flow is present.

8. Go to a project in the subgroup of the group e.g. http://gdk.test:3000/gitlab-duo/duo-subgroup/duo-subgroup-project/-/automate/flows
9. Verify the project in the subgroups has the flows enabled

10. Go back to the group admin settings and disable the flow, click save changes. Verify in the Flow menu of the group and project that the Flow has been removed.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #583731