Add tool coverage card to security inventory

What does this MR do and why?

Add tool coverage card to security inventory

Add a tool coverage card to the top of the group security inventory
page. ToolCoverageCard lists the four coverage states with counts read
from the existing group.analyzerStatuses field, and ToolCoverageChart
draws the donut beside them.

Build the donut from a GlChart pie series with an inner radius, colored
to match the segmented bars in the inventory table so a status looks the
same in both places. Count descendant groups recursively and skip
archived ones so the group figure covers the same scope as the project
total. Move the analyzer status aggregation into a shared util so the
card and the table indicator do not duplicate it.

Gate behind the security_inventory_tool_coverage_card feature flag

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/527861

References

• epic: Security Inventory: UX and Usability Improvements (gitlab-org#22124)
• designs: Design: Dashboard summary widgets for security ... (#527861)
  • thread about whether we count projects or project+scanner pairs: /-/work_items/527861/designs/01-default-view.png#note_3732640110
• feature documentation: https://docs.gitlab.com/user/application_security/security_inventory/

Screenshots or screen recordings

Before	After

How to set up and validate locally

0. git checkout 527861-add-tool-coverage-card-to-security-inventory
   echo "Feature.enable(:security_inventory_tool_coverage_card)" | gdk rails c

1. have a GitLab Ultimate licence
2. go to a group => Secure => Security inventory
3. check that a Tool coverage card is shown at the top of the page, above the project list and search bar
4. check that the card shows:
   • a donut chart
   • a legend with Enabled, Failed, Stale, Not enabled rows, each with a count
   • a scanner filter dropdown
   • a summary line reading Coverage across N groups and M projects
   • a View configuration link
   • a help popover on the card title
5. click View configuration and check that it leads to the group's security configuration page
6. open the scanner filter dropdown and switch to a specific scanner, confirm that the counts and chart change accordingly

also worth checking

7. check that the existing tool coverage indicator is unaffected (the aggregation logic behind the card was extracted out of the per-project indicator into a shared util, so both now use the same code path)
8. go to a group with no projects and check that the card does not error

to run tests

yarn install && yarn jest ee/spec/frontend/security_inventory

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #527861