Add Service Ping metrics for restricted AI Catalog items

What does this MR do and why?

The ai_catalog_items table has a visibility enum (private, restricted, public). !247614 (merged) made this enum the single source of truth for reads, replacing the old public boolean. During review on that MR it came up that the four existing Service Ping metrics for AI Catalog agents and flows only count public and private items; restricted items aren't counted anywhere.

This MR adds two new metric definitions, counts.ai_catalog_restricted_flows and counts.ai_catalog_restricted_agents, mirroring the existing public/private ones. They reuse the existing CountAiCatalogItemsMetric instrumentation class with options: { item_type: ..., visibility: restricted }, so no instrumentation code changes were needed. Specs were extended to cover the restricted case.

References

#608275 (closed)

How to set up and validate locally

Steps to verify the new metrics

1. Watch the metrics live while creating items:

   rails runner scripts/internal_events/monitor.rb counts.ai_catalog_restricted_flows counts.ai_catalog_restricted_agents

   • Create an agent or flow with restricted visibility in the AI Catalog and the matching count goes up.
   • Create a public or private item and confirm the restricted counts stay flat, so the visibility filter is actually applied.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #608275 (closed)