Add database schema for security tracked context quota

What does this MR do and why?

Adds organization-level quota setting for SecurityProjectTrackedContext records. This limits the number of tracked branches per organization during the Vulnerabilities Across Contexts (VAC) closed beta rollout.

Changes

1. Organization settings (JSONB):

   • Add security_tracked_context_quota to organization_settings.settings JSONB column
   • Add EE extension for Organizations::OrganizationSetting with validation and helper methods

2. Application settings:

   • Add default_security_tracked_context_quota to application_settings (default: 2)
   • This provides the SaaS-wide default for organizations that haven't set their own quota

3. Helper methods on OrganizationSetting:

   • security_tracked_context_quota_with_default - returns explicit value OR SaaS default (2)
   • security_tracked_context_quota_explicitly_set? - returns true if organization has set an explicit quota

Closed Beta Behavior

• All VAC-enabled organizations get a quota of 2 by default (on GitLab.com)
• Admins can set explicit quota per organization to grant more capacity
• Self-managed instances have no quota enforcement (returns nil)

Related issues

Closes #585969

Part of &20475 (Tracked Context Quota Management)

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

# In rails console
org = Organizations::Organization.first
setting = Organizations::OrganizationSetting.for(org.id)

# Test explicit quota
setting.security_tracked_context_quota = 5
setting.security_tracked_context_quota_with_default # => 5
setting.security_tracked_context_quota_explicitly_set? # => true

# Test default (on SaaS)
setting.security_tracked_context_quota = nil
setting.security_tracked_context_quota_with_default # => 2 (on SaaS), nil (self-managed)
setting.security_tracked_context_quota_explicitly_set? # => false