Add validity checks for the remaining OpenAI token types

This merge request extends OpenAI coverage to three more of the four token types GitLab detects.

Resolves #628281 (closed).

Gap

• GitLab detects four OpenAI token types, but validity checks only verified the project key (sk_proj_).
• The following token types had no verifier:
  • OpenAiServiceAccountKey
  • OpenAiServiceAdminKey (which is basically an admin key)
  • open ai token (which is basically a user key)

Fix

• We split the single flat OpenaiClient into Openai::Base and Openai::ProjectKey. This is the layout ADR-006 prescribes.
• We pin the metrics label partner to openai in the Openai::Base class. This means all verifiers use the same label.
• We add three new validity checks, each only enabled for GSS findings:
  • OpenAiServiceAccountKey – validated using GET /v1/models.
  • OpenAiServiceAdminKey – validated using GET /v1/organization/admin_api_keys.
  • open ai token – validated using GET /v1/models.
• Every endpoint choice was test against a real key of that type, not inferred.
• We also updated handling for 403 status code as OpenAI uses 403 for permissions refusal:
  • Those missing scopes map to active, because OpenAI returns that only after resolving the key.
  • The "Country, region, or territory not supported" error, stays unknown, because that cause does not depend on the key.

Notes

• The existing 401 handling is unchanged:
  • We return inactive only for OpenAI's invalid_api_key code.
  • We return unknown for the other three documented 401 causes, which describe a live key the request cannot use.

MR acceptance checklist

I have evaluated this MR against the MR acceptance checklist.