Show confirmation modal when disabling secrets manager

What does this MR do and why?

Currently, users can just turn the toggle off to disable (unenroll) the secrets manager. This MR adds a confirmation step to ensure that the user understands the consequences of disabling the secrets manager before proceeding.

This change applies only when the secrets_manager_paid_experience is enabled, since we inform the users about the trial in the modal. This applies to both SaaS and self-managed, but for airgapped we don't provide the trial so this is removed from the modal description.

Air-gapped is detected from the license, not from the entitlement state. instance_secrets_manager_enrollment_data in ee/app/helpers/secrets_helper.rb now exposes offline_license, which is true when the current license is not an online cloud license. This is the signal to use for hiding the trial note: OFFLINE_PAID alone is not enough, because an air-gapped instance without an active purchase resolves to BLOCKED, the same state as an online instance past its grace period.

References

Implements https://gitlab.com/gitlab-org/gitlab/-/work_items/623335

Screenshots or screen recordings

TLG settings (SaaS)	Admin settings (self-managed)	Admin settings (self-managed, airgapped)

How to set up and validate locally

Setting up the secrets manager

1. When starting gdk, use GITLAB_SIMULATE_SAAS=1 gdk start to emulate SaaS, gdk start for self-managed.
2. Upload a Premium license (or above).
3. Set up the GDK with OpenBao: https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/openbao.md
4. Enable the following feature flags: secrets_manager, group_secrets_manager, secrets_manager_namespace_enrollment (for SaaS), secrets_manager_instance_enrollment (for self-managed), secrets_manager_paid_experience.

Verifying the feature

The entitlement resolver communicates with the CDot API. We will monkey-patch this and mock the results of the API so we can control the entitlement state locally.

To mock the API, add these files config/secrets_manager_stub.yml and config/initializers/zz_secrets_manager_stub.rb and restart your gdk. This will mock the entitlement state returned by GraphQL (which we normally get from CDot).

secrets_manager_stub.yml

zz_secrets_manager_stub.rb

This automatically sets the entitlement state to trial_eligible and will set it to trial when the trial mutation is triggered.

For SaaS

1. Visit a TLG's /-/secrets page.
2. Click on "Start 30-day trial" button and wait for the process to succeed.
3. Go to the secrets manager settings (Settings > General > Permissions and group features > Secrets manager) and try to disable the toggle.

For self-managed

1. Go to the secrets manager settings from the Admin settings http://gdk.test:3000/admin/application_settings/general.
2. Try to disable the toggle.
3. To test for airgapped, change entitlement.state to offline_paid in config/secrets_manager_stub.yml. No need to restart gdk.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.