Revoke Artifact Registry owner role on organization removal

What does this MR do and why?

Completes the Artifact Registry owner-role sync from !250806 (merged) (promote/demote) by covering the two gaps left in #627181 (closed):

1. Organizations::OrganizationUsers::DestroyService had no hook into the sync, so a removed owner kept their organization_admin grant — Artifact Registry validates tokens locally against the IAM Relationships API tuple, not by calling back to Rails.
2. RevokeOwnerRoleWorker required a current organization owner as the acting user, so a user leaving on their own (or self-demoting) had no valid actor: they are no longer an owner by the time the job runs, and borrowing another owner's identity would misrepresent who performed the write in IAM's record.

This adds the same EE override pattern used for promote/demote to the destroy path (first commit), and lets the worker authorize a self-revoke as the user themselves (second commit), relying on IAM's new self-delete rule: a caller may delete their own grant regardless of role, since that can only reduce access.

References

• Part of #627181 (closed)
• Builds on !250806 (merged)
• Builds on gitlab-org/auth/iam!594 (merged), now merged — the self-delete rule this MR relies on is live.

Screenshots or screen recordings

Not applicable — backend-only change, no UI surface.

How to set up and validate locally

1. Feature.enable(:artifact_registry_role_assignment) in a Rails console.
2. Create an organization with two owners.
3. Remove one via Organizations::OrganizationUsers::DestroyService.new(organization_user, current_user: other_owner.user).execute, or have an owner leave by passing themselves as current_user.
4. Confirm Authz::Organizations::RevokeOwnerRoleWorker is enqueued with the removed user's id and the acting user's id (themselves, for a self-leave).
5. bundle exec rspec ee/spec/services/ee/organizations/organization_users/destroy_service_spec.rb ee/spec/workers/authz/organizations/revoke_owner_role_worker_spec.rb

MR acceptance checklist

Evaluated against the MR acceptance checklist:

• Mirrors the existing UpdateService / RevokeOwnerRoleWorker patterns; EE injection via prepend_mod.
• Touches IAM role-revocation authorization — flagging for @gitlab-com/gl-security/appsec awareness, even though it doesn't introduce new access, only a new authorized path for self-revocation already implemented on the IAM side.
• No new feature flag: the existing artifact_registry_role_assignment flag (wip, default-off) already gates this path.
• Tests added/updated for both changes; full local suite green.
• No changelog trailer: change is behind a default-off feature flag.