Find namespaces by full path in the token scope picker

What does this MR do and why?

Adds a full-path lookup (project(fullPath:) / group(fullPath:)) to the fine-grained PAT namespace picker's query, and surfaces the resolved match at the top of the existing Groups/Projects sections, de-duplicated by id.

Fine-grained PAT boundaries no longer require membership on the backend, but the picker still only queried the user's own memberships, so it could not express a boundary the backend now accepts. Querying all accessible namespaces instead was rejected: that approach is a known performance problem in the MR approvers picker. An exact full-path lookup is a single indexed lookup instead of a trigram search. This mirrors @ mention autocomplete, which also pairs bounded suggestions with an exact full-path escape hatch.

References

• #629667 (closed) - removed the membership requirement for fine-grained PAT boundaries
• !256288 (merged) - implemented that change, replacing boundary.member? with read_boundary
• !256456 (merged) - changed the picker's option labels to say "access to" instead of "member of"
• #425749 (closed) - performance problem with searching all accessible groups, in the MR approvers picker

Screenshots or screen recordings

Before	After

Screenshots still need to be attached, since this change affects the UI.

How to set up and validate locally

1. Ensure the granular_personal_access_tokens feature flag is enabled (default enabled).
2. Go to /-/user_settings/personal_access_tokens.
3. Choose the option to scope the token to specific groups or projects.
4. Type the full path of a public project you are not a member of.
5. Confirm it appears in the list, can be selected, and the token can be created with it as the boundary.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.