Refactor and clean up remaining AvoidUserOrganization usages

What does this MR do and why?

This MR resolves the remaining entries in .rubocop_todo/gitlab/avoid_user_organization.yml following maintainer feedback.

Refactors:

• Replaced User#organization with Current.organization in request-layer code (Admin::UsersHelper).

• Updated Keys::CreateService to require organization to be passed explicitly instead of inferring it from the user.

• Updated ImportGistWorker to use Current.organization.

• Updated SpamAbuseEventsWorker to use target.sharding_organization instead of deriving from User#organization.

• Removed the fallback in Ai::Conversation::Thread.

Permanent exclusions:

The following files were intentionally excluded and moved from .rubocop_todo into .rubocop.yml, with justification:

• app/models/todo.rb

• app/services/audit_event_service.rb

• ee/lib/tasks/gitlab/nav/dump_structure.rb

• lib/gitlab/seeders/ci/runner/runner_fleet_seeder.rb

Each exclusion was reviewed to ensure there is a clear, layer-appropriate reason for keeping User#organization.

This aligns with the intent of the AvoidUserOrganization cop: prefer Current.organization in request contexts and avoid implicitly deriving organization from the user unless it is structurally required.

References

• Fix AvoidUserOrganization cop todos

• Related to #562375 (closed)

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.