Fix NoMethodError in expired-namespace policy unassign worker

What does this MR do and why?

Security::UnassignPolicyConfigurationsForExpiredNamespaceWorker#perform looked up the namespace via Namespace.find_by_id, then called self_and_descendants_ids on it. That method is defined only on Group, not on Namespace in general. Two enqueue paths in UnassignPolicyConfigurationsForExpiredLicensesCronWorker can hand this worker a personal namespace (Namespaces::UserNamespace) — SaaS subscriptions can belong to a personal namespace, and self-managed scheduling iterates Namespace.top_level, which includes personal namespaces. When that happens the worker raises NoMethodError before doing any work, so that namespace's policy configurations are never unassigned after entitlement expiry.

Policy configurations only ever hang off groups and their projects, so the fix looks up the namespace as a Group directly (Group.find_by_id) instead of Namespace.find_by_id. Non-group namespace IDs now return early, same as a missing namespace.

References

#607095 (closed)

Screenshots or screen recordings

Not applicable — backend worker fix, no UI change.

How to set up and validate locally

1. bundle exec rspec ee/spec/workers/security/unassign_policy_configurations_for_expired_namespace_worker_spec.rb
2. The added example ("when namespace is not a group") reproduces the reported NoMethodError against Namespace.find_by_id and passes with the Group.find_by_id fix.

MR acceptance checklist

Evaluated against the MR acceptance checklist: backend-only bug fix, single-line root-cause change, regression test added, RuboCop clean, no feature flag needed (restores existing intended behavior, no new behavior surface).