Use OpenBao ACL to determine showing New secret button

What does this MR do and why?

This fixes a bug where the New secret button doesn't render after enabling the add-on or starting a trial for the secrets manager.

We were using the Rails-injected can_create_secrets permission which was based on Role-based policies. But after the secrets manager is provisioned (happens after enabling the add-on or starting a trial), the OpenBao ACL takes precedence over the Rails-provided policies. So this MR makes sure that we fetch userPermissions after provisioning to determine if we can show the New secret button.

We will use userPermissions to gate other actions/buttons in the UI in future MRs. For now, this MR just fixes the missing button bug.

References

Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/631373 and addresses the follow-up from !256976 (comment 3900517698).

Screenshots or screen recordings

Before	After

How to set up and validate locally

Setting up the secrets manager

1. Run gdk on SaaS: GITLAB_SIMULATE_SAAS=1 gdk start.

2. Set up the GDK with OpenBao: https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/openbao.md

3. Enable the following feature flags: secrets_manager, group_secrets_manager, secrets_manager_paid_experience, secrets_manager_namespace_enrollment.

4. Create a new top-level group. This will be our test group.

5. The entitlement resolver communicates with the CDot API. We will monkey-patch this and mock the results of the API so we can control the entitlement state locally. To mock the API, add these files config/secrets_manager_stub.yml and config/initializers/zz_secrets_manager_stub.rb and restart your gdk. This will mock the entitlement state returned by GraphQL (which we normally get from CDot).

   secrets_manager_stub.yml

   zz_secrets_manager_stub.rb

These will allow you to test with different entitlement states. By default, it is trial_eligible. If you need to clear/reset the cached entitlement, run SecretsManagement::Entitlement.stub_reset! from the rails console.

Verifying the feature

1. Make sure the entitlement state in config/secrets_manager_stub.yml is set to trial_eligible.
2. Go to the secrets manager of your group (/-/secrets) and click on "Enable add-on" or "Start 30-day trial"
3. When the request passes, verify that you see the New secret button.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.