Add :self_managed_welcome_onboarding feature flag and initial controller skeleton

What does this MR do and why?

Adds the initial scaffolding for the self-managed admin welcome flow behind the self_managed_welcome_flow feature flag. After sign-in, admins with no groups are redirected to /admin/registrations/groups/new - a stub page that will gain the create-group form in a follow-up MR.

For historical purposes - this is a vertically sliced iterative approach to the initial work in this MR that we have cut down for ease of review.

The service layer and view layer will be coming in MRs two and three.

Merge order: This is MR 1 of 3.

Related issue: 579942

Changes

• Redirect logic in SessionsController#after_sign_in_path_for - redirects root admins to the onboarding path on first-time login
• Admin::Registrations::GroupsController - new controller with new action only, gated by feature flag and admin check
• Feature flag self_managed_welcome_onboarding (instance-scoped, group::acquisition)
• Adds Route GET /admin/registrations/groups/new

MR acceptance checklist

This MR does not introduce a database migration Feature flag is defaulted to off Tests cover the redirect logic and the feature-flag gate

Screenshots or screen recordings

Before	After

How to set up and validate locally

Enable the feature flag:

1. Feature.enable(:self_managed_welcome_onboarding)

2. Set export GITLAB_SIMULATE_SAAS=0 and then run gdk reset-data and gdk restart if needed

3. Comment out !Group.exists? in should_redirect_to_sm_onboarding?(resource) or delete your groups prior to signing in (after trying both, just comment out the line - much easier)

4. Sign in as the admin root user

5. Set new root password

6. Confirm you are redirected to /admin/registrations/groups/new - page should be blank with a page title

7. (Optional) Disable the flag and confirm the redirect no longer occurs