Show Secrets Manager entitlement banners on group Secure settings

What does this MR do and why?

This is the second MR in the series to update the secrets manager banner states to match the design specs. Pt.1 (!257125 (merged)) updated banner copy and extracted reusable trial / credit-consumption alert components. This MR mirrors those banner states onto the secrets manager settings block on the top-level group's Secure settings page (GitLab.com only), all behind the secrets_manager_paid_experience feature flag.

Main changes:

• Secure settings banners: top-level group Secure settings block (SaaS only) now mirrors the secrets page's entitlement banners (beta, trial, credit consumption).
  • Never shown on subgroups, projects, or self-managed.
• Beta groups now visible: the block now renders for trial-eligible beta top-level groups, so the beta alert can show its buttons.
• Trial button gating: buttons show only for users who can start a trial, via new can_start_trial in namespace_enrollment_data.
• Button behavior: each button runs one mutation (start trial or enable add-on) then refetches the entitlement; toggle disabled during the request, errors shown inline.
• Beta alert decoupled: the beta transition alert now takes a showCta prop from its parent instead of injecting the values itself.
• Self-managed secrets page: now shows the beta-ended alert too (previously GitLab.com only).
  • The countdown stays GitLab.com-only: end_secrets_manager_beta_program has no self-managed rollout yet.
• Billing alert trimmed: SecretsManagerBillingAlert is reduced to the open-beta notice; three strings removed from gitlab.pot.

Why the settings block buttons don't enroll or provision

• The beta alert only renders for groups already enrolled in the beta, and the trial mutation has no enrollment precondition.
• Beta groups are normally already provisioned; if not, the secrets page provisions on first use.
• Provisioning (initialize, status polling, alerts) already lives in the secrets page — duplicating it here was judged too complex.

References

#629113 (closed)

Also related to https://gitlab.com/gitlab-org/gitlab/-/work_items/630794

Screenshots or screen recordings

State	Before	After
Beta ended
Trial
Trial expired
Paid
Paid & Disabled

How to set up and validate locally

1. Run GDK as SaaS: GITLAB_SIMULATE_SAAS=1 gdk start

2. Set up OpenBao: https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/openbao.md

3. Enable feature flags: secrets_manager, group_secrets_manager, secrets_manager_namespace_enrollment, secrets_manager_paid_experience.

4. Stub the CustomersDot entitlement with the dev-only resolver stub from !253618 (merged). It reads tmp/gsm_entitlement_stub on every request, one line per group, for example:

   my-group: trial_eligible on_demand

5. Pick a top-level group with Secrets Manager enabled and visit http://gdk.test:3000/groups/<group>/-/settings/secure#js-secrets-manager-settings. Change the group's stub line and reload for each state:

   State	Setup	Expected on the Secure settings block
   Beta window open	trial_eligible on_demand, plus in the rails console SecretsManagement::NamespaceEnrollment.find_or_create_by!(namespace: group).update!(beta: true) and Feature.disable(:end_secrets_manager_beta_program)	Warning "Your free beta ends in …" alert with Enable with GitLab Credits and Start 30-day trial
   Beta ended	Same as above, plus Feature.enable(:end_secrets_manager_beta_program, group)	Danger "Your Beta period is over…" alert with the same buttons
   Trial	trial on_demand	Trial alert with credits % and days left
   Trial expired	trial_expired	Danger "GitLab Secrets Manager is disabled" alert with the Customer Portal link; toggle disabled
   Paid	paid on_demand	Info alert: "GitLab Secrets Manager consumes GitLab Credits…"
   Paid and disabled	paid on_demand, then turn the toggle off	Info alert: "Project and group members can only view details or delete existing secrets…"

6. Buttons (beta states): Start 30-day trial opens the trial modal and, on confirm, the block switches to the trial alert. Enable with GitLab Credits opens the add-on modal and, on confirm, the block switches to the paid alert. The toggle is disabled while the request runs. To retry the add-on flow: SecretsManagement::NamespaceEnrollment.find_by(namespace_id: group.id).update!(add_on_requested_at: nil).

7. Check that no entitlement banners render on a subgroup's Settings > General page, or on the Secure settings page of a self-managed instance (restart GDK without GITLAB_SIMULATE_SAAS).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.