Add Enable with GitLab Credits flow to Secrets Manager beta banner

What does this MR do and why?

Adds a way for beta-cohort top-level groups to enable the paid GitLab Secrets Manager add-on directly from the beta-transition banner, using GitLab Credits instead of starting a trial. This lets eligible groups skip the trial period and move straight to the paid add-on when they have credits available. The whole flow is gated behind the default-off feature flag secrets_manager_paid_experience and is stacked on backend MR !253618 (merged), which adds the secretsManagerEnableAddOn GraphQL mutation this MR calls.

• Adds an "Enable with GitLab Credits" button next to "Start 30-day trial" on the beta-transition banner (shown to trial_eligible beta-cohort groups on GitLab.com).
• Adds a confirmation modal with two variants based on the entitlement's onDemandEnabled:
  • on-demand enabled: explains credit usage and confirms via the secretsManagerEnableAddOn mutation.
  • on-demand disabled: explains that the group has no GitLab Credits available, with links to the Customer Portal and credits docs, and no action button.
• Wires up loading state on the banner button (spinner + "do not close this page" popover) while the mutation runs, and a success alert once the group is enabled.

The modal being added here will be reused from other entry points to enable the paid add on.

References

Screenshots or screen recordings

Happy path case, group has onDemandEnabled = true

Alternative path, group has onDemandEnabled = false

How to set up and validate locally

Validating this change locally requires several steps. It requires a top level group enrolled in the secrets manager beta, a spoof for the responses for the onDemandEnabled status, and baseline setup for secrets manager.

Setup

1. Follow the first setup steps (excluding the group step, see below) from the backend MR description (!253618 (merged)): dev stub config/initializers/gsm_entitlement_dev_stub.rb, prepare a group (see next step), GDK running with GITLAB_SIMULATE_SAAS=1, and OpenBao running.
2. Prepare a top-level group you own** (example uses flightjs) in a Rails console:

group = Group.find_by_full_path('flightjs')

plan = Plan.find_by(name: 'ultimate')                 # for native_secrets_management licensing
sub  = group.gitlab_subscription
sub ? sub.update!(hosted_plan: plan) : GitlabSubscription.create!(namespace: group, hosted_plan: plan)

Feature.enable(:secrets_manager_paid_experience, group)
Feature.enable(:secrets_manager_namespace_enrollment, group)

# Beta cohort, enabled, no add-on intent yet -> resolves trial_eligible.
# find_or_initialize handles a group that already has an enrollment (unique per namespace).
enr = SecretsManagement::NamespaceEnrollment.find_or_initialize_by(namespace: group)
enr.update!(beta: true, disabled_at: nil, add_on_requested_at: nil)

Validate

1. Navigate to the secrets manager page (Secure > Secrets Manager)
2. Verify the beta transition banner appears, and that the Enable with GitLab Credits button functions as expected (i.e opens modal, mutation runs, etc.)

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.