Remove the disable_security_manager spec tag

What does this MR do and why?

Stacked on !256052 (merged). Target branch is that MR, not master.

SecurityManagerConfig.enabled? returns a literal true, so every spec using :disable_security_manager covers a state that cannot happen in production. They pass only because of a test-only stub.

• Removed the 11 remaining :disable_security_manager contexts across 9 spec files.
• Removed the tag handler from spec/spec_helper.rb and the entry from spec/support/known_rspec_metadata_keys.yml.
• Flattened the wrapper contexts left behind, and added :aggregate_failures to the 3 examples that have more than one expectation.

No production code changes. After this each of the 7 remaining call sites is a one-line removal with no spec churn.

How to set up and validate locally

bundle exec rspec spec/lib/gitlab/access_spec.rb spec/presenters/group_member_presenter_spec.rb spec/graphql/types/access_level_enum_spec.rb ee/spec/graphql/resolvers/members/standard_roles_resolver_spec.rb ee/spec/graphql/types/gitlab_subscriptions/user_role_enum_spec.rb ee/spec/lib/gitlab/custom_roles/definition_spec.rb
bundle exec rspec spec/models/group_spec.rb:4669 spec/models/member_spec.rb:733 spec/helpers/projects_helper_spec.rb:1504

153 examples, 0 failures.

References

#584144 (closed)

Part of the work in !239507 (closed)

Screenshots or screen recordings

No UI change.

🤖 Generated with Claude Code