Authenticate self-hosted billing events with CustomersDot token

What does this MR do and why?

Since 19.4, Code Suggestions fail with HTTP 403 (Forbidden by auth provider) on Self-Managed instances that use GitLab Duo Self-Hosted with an online cloud license.

Before each suggestion, GitLab sends a billing event to GitLab's cloud Duo Workflow Service. Since !250313 (merged), this call uses the instance's self-signed token. The cloud service cannot verify that token, rejects the call, and the suggestion is blocked before it reaches the AI Gateway.

This MR sends the CustomersDot-issued instance JWT for the billing call again, as ConnectionConfigService#cloud_service_for_self_hosted already does. The token is passed into Gitlab::AiGateway.headers through a new optional bearer_token: argument, so no self-signed token is created for this call. If the CustomersDot-issued instance JWT is missing, the billing call returns a clear error instead of falling back to a self-signed token. Calls to the self-hosted AI Gateway keep using the self-signed token.

Not in this MR:

• Whether a failed billing call should block Code Suggestions at all. That is a product decision and can be discussed in the issue.
• Moving the token choice out of Gitlab::AiGateway.headers and clarifying the token names. This is planned as a follow-up.

References

• Issue: #630581 (closed)
• Regression introduced by: !250313 (merged)

Screenshots or screen recordings

Not applicable, no UI change.

How to set up and validate locally

1. Run bin/rspec ee/spec/lib/ai/duo_workflow/duo_workflow_service/client_spec.rb ee/spec/lib/gitlab/ai_gateway_spec.rb. The new examples check that the billing call sends the CustomersDot-issued instance JWT, creates no self-signed token, and returns an error when the JWT is missing. They fail without this fix.
2. Optional, end to end: on a Self-Managed instance with an online cloud license and a self-hosted model for Code Suggestions, POST /api/v4/code_suggestions/completions returns 200 instead of 403.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.