Add Enable with GitLab Credits button to Secrets Manager empty state

What does this MR do and why?

This MR implements the Enable with GitLab Credits button for the non-beta non-trial state. It also updates the empty state to match the designs more closely, primarily updating the footer text and making the trial help link actually go to the trial section of the doc.

References

Builds off the same flow added in !253763 (merged)

https://gitlab.com/gitlab-org/gitlab/-/work_items/623325

Screenshots or screen recordings

Before	After

When on-demand is false:

When on-demand is true

How to set up and validate locally

claude is great at handling this setup

Validating this change requires a non-beta top-level group whose entitlement resolves to trial_eligible (so the trial empty state renders with the buttons), a spoof for the onDemandEnabled status, and the baseline Secrets Manager setup. It is gated behind the default-off secrets_manager_paid_experience flag.

Setup

1. Follow the setup from the backend MR description: the dev stub config/initializers/gsm_entitlement_dev_stub.rb, GDK running with GITLAB_SIMULATE_SAAS=1, and OpenBao running.

2. Prepare a top-level group you own (example uses flightjs) in a Rails console. Note beta: false — this is the key difference from the banner flow; a non-beta trial_eligible group renders the trial empty state directly:

   group = Group.find_by_full_path('flightjs')
   
   plan = Plan.find_by(name: 'ultimate')                 # for native_secrets_management licensing
   sub  = group.gitlab_subscription
   sub ? sub.update!(hosted_plan: plan) : GitlabSubscription.create!(namespace: group, hosted_plan: plan)
   
   Feature.enable(:secrets_manager_paid_experience, group)
   Feature.enable(:secrets_manager_namespace_enrollment, group)
   
   # Non-beta, enabled, no add-on intent yet -> resolves trial_eligible and
   # shows the trial empty state (not the beta banner).
   enr = SecretsManagement::NamespaceEnrollment.find_or_initialize_by(namespace: group)
   enr.update!(beta: false, disabled_at: nil, add_on_requested_at: nil)

3. Set the entitlement stub to a trial_eligible state with credits available:

   echo "trial_eligible on_demand" > tmp/gsm_entitlement_stub

Validate

1. Navigate to the Secrets Manager page (Secure > Secrets Manager).
2. Verify the trial empty state appears with Enable with GitLab Credits (primary) next to Start 30-day trial, a "Learn more about the 30-day trial" link, and a single-line billing footer.
3. Confirm the "Learn more" link points to the trial section of the billing docs (…/secrets_manager_billing#start-a-trial).
4. Happy path (credits available): with the stub at trial_eligible on_demand, click Enable with GitLab Credits. The modal's enable variant opens; confirm it → the button shows a spinner + "do not close this page" popover, the secretsManagerEnableAddOn mutation runs, a success alert appears, and the entitlement flips to paid.
5. No-credits variant: set the stub to trial_eligible (drop on_demand) and reload. Click Enable → the modal shows the "no GitLab Credits available" variant (Customer Portal + credits-docs links, no action button).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.