Resolve instance-level SSH CAs in /internal/authorized_certs

What does this MR do and why?

Resolve instance-level SSH CAs in /internal/authorized_certs

Update endpoint to handle instance level ssh certificates.

It checks group level certificates and falls back to the instance service when no group CA matches the fingerprint.

When neither service finds a matching certificate the error comes from the scope that matched the fingerprint. Both find services return semantic reasons so the endpoint can tell a missing certificate from a denial, and the endpoint maps those reasons to HTTP statuses. Group-only resolution is unaffected: the group error still wins whenever a group CA claimed the fingerprint.

Every group failure still falls through to the instance scope, including a member who is not an enterprise user of the group and a group that is not licensed for ssh_certificates.

Related to #611274 (closed)

How to set up and validate locally

1. Confirm the GDK instance is not configured as SaaS. The feature is not available on GitLab.com.
2. Enable the flag in the Rails console:

   Feature.enable(:instance_ssh_certificates)

3. Create an instance CA in the Rails console. The fingerprint is derived from the key:

   InstanceSshCertificate.create!(title: 'Test CA', key: File.read('/path/to/ca_key.pub'))

4. The endpoint requires a GitLab Shell JWT, so exercise it through the request specs:

   bundle exec rspec ee/spec/requests/api/internal/base_spec.rb -e "GET /internal/authorized_certs"

5. Confirm an instance match returns {"success":true,"instance":true,"username":"..."} with no namespace key.
6. Register a group CA for the same fingerprint and confirm the group match wins, and that a group denial still falls through to the instance CA.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #611274 (closed)