Hide unactionable secrets manager settings in the paid experience

What does this MR do and why?

⚠️ Depends on !258310 (merged) to be merged first.

We have a rendering bug where sometimes the secrets manager is in a state where it's unavailable or not actionable, but we still show the settings. This may cause confusion to users since we're not providing the proper guidance.

In these cases, since the secrets manager isn't actionable, it's better to hide the settings until they are actionable. This happens usually when the secrets manager is not yet provisioned (the provisioning happens from the secrets manager page itself).

References

This fixes the bug in https://gitlab.com/gitlab-org/gitlab/-/work_items/628837#note_3841849067 (scoped in #601817 (closed))

Screenshots or screen recordings

State	Before	After
Unprovisioned project
Unprovisioned TLG (with entitlement trial or paid entitlement state)		Settings > Secure is not available
(SaaS) When entitlement is trial_eligible

For the case where the entitlement is trial_eligible on SaaS, we are not fetching the entitlement state for the sidebar links in case a CDot outage resolves the entitlement to ineligible when it that isn't necessarily the case. This would affect more than just the secrets manager, so we have to be careful about gating the sidebar link here. The compromise instead is to add some guidance in the settings so that instead of an empty inactionable settings, we nudge the user to go to the secrets manager page instead. See !257554 (comment 3915503632), for the related discussion.

How to set up and validate locally

Setting up the secrets manager

1. If testing SaaS, run GITLAB_SIMULATE_SAAS=1 gdk start; otherwise, gdk update tests self-managed.

2. Set up the GDK with OpenBao: https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/openbao.md

3. Enable the following feature flags: secrets_manager, group_secrets_manager, secrets_manager_paid_experience. Enable secrets_manager_namespace_enrollment if testing SaaS; secrets_manager_instance_enrollment if self-managed.

4. Create a new top-level group. This will be our test group. Add another Reporter+ user here (not Owner).

5. The entitlement resolver communicates with the CDot API. We will monkey-patch this and mock the results of the API so we can control the entitlement state locally. To mock the API, add these files config/secrets_manager_stub.yml and config/initializers/zz_secrets_manager_stub.rb and restart your gdk. This will mock the entitlement state returned by GraphQL (which we normally get from CDot).

   secrets_manager_stub.yml

   zz_secrets_manager_stub.rb

These will allow you to test with different entitlement states. By default, it is trial_eligible. If you need to clear/reset the cached entitlement, run SecretsManagement::Entitlement.stub_reset! from the rails console.

Verifying the feature

1. Set the entitlement state in secrets_manager_stub.yml to paid. This adds an entitlement to the secrets manager without provisioning.
2. If testing on self-managed, enable the secrets manager for your instance by going to Settings > General > GitLab Secrets Manager
3. You can verify the state of the settings in Settings > Secure

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.