Fold last used ips into PersonalAccessToken and remove flag

What does this MR do and why?

This MR does two things:

1. Removes the expose_last_used_ips_for_access_tokens feature flag. With the flag gone, last_used_ips is exposed for group, project, and impersonation tokens too. It was already exposed for personal access tokens.
2. Deletes the PersonalAccessTokenWithLastUsedIps entity. It could not coexist with PersonalAccessTokenWithToken under single inheritance, so last_used_ips now lives on the base PersonalAccessToken entity. As a result the field is exposed consistently across every token type, via both REST and GraphQL, rather than only on the endpoints that opted into the subclass.

N+1 safety: every collection endpoint that presents the entity preloads via preload_last_used_ips, and this is covered by request specs. The measured impact is +1 batched query per request with no latency change (see #603636 (closed)).

Where last_used_ips is exposed, and to whom

Endpoints that return a populated last_used_ips array, and who can see them. Create and rotate responses are omitted: the token is brand new, so the array is always empty there.

Endpoint(s)	Who can see it	Whose IPs	Change
GET /personal_access_tokens, /:id, /self	the token owner, or an instance admin	the caller's own tokens	No change - already visible (also via GraphQL)
GET /users/:user_id/impersonation_tokens, /:id; POST /admin/token	instance admin	any user's token	No change - admin already sees everything
GET /projects/:id/access_tokens, GET /groups/:id/access_tokens (+ /:token_id)	project maintainer / group owner	a bot or CI runner	New in practice - written in 19.2 but never live
GET /{projects,groups}/:id/service_accounts/:user_id/personal_access_tokens	project / group owner	a service account	New
GET /groups/:id/manage/resource_access_tokens	group owner (SaaS, credentials inventory)	a bot	Was flag-gated, now unconditional
GET /groups/:id/manage/personal_access_tokens	group owner (SaaS, credentials inventory)	an enterprise user (a real person)	New - the only case where a real person's IP becomes visible to someone who could not see it before

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.