Enforce seat type restrictions on members for default roles

What does this MR do and why?

Part of https://gitlab.com/gitlab-org/gitlab/-/work_items/607620+

Adds a model-level validation that rejects a role outside the set its seat type permits, for default roles only (custom roles to be addressed in a follow-up MR !251013 (merged)).

The validation lives on Member because paths that create or change membership ultimately save a Member, including the add_member callers that bypass Members::CreateService so a service layer check can't cover them. That includes LDAP, SAML, and SCIM sync paths, and also service account and access token provisioning.

The feature is gated behind the seat_assignment_model feature flag.

References

• https://gitlab.com/gitlab-org/gitlab/-/work_items/607620+

Screenshots or screen recordings

Before	After

How to set up and validate locally

Green pipeline 🟢

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #607620