Set a 2 second connect timeout on the usage quota check

What does this MR do and why?

Ai::UsageQuotaService asks the subscription portal for the usage quota when its cache is cold. That HEAD request, verify_usage_quota, passes no timeout, so Gitlab::HTTP waits up to 10 seconds to open the connection, once for each IP family the portal resolves to. When the connection hangs, each cold-cache check waits at least 10 seconds before it fails open.

This MR limits the connection attempt to 2 seconds, the value SecretsManagement::Entitlement::DEFAULT_HTTP_TIMEOUT_SECONDS already uses for the same api/v1/consumers/resolve endpoint, so a hung connection gives up after about 2 seconds per IP family. The read and write keep their 20 and 30 second defaults, which leaves a stalled read unchanged. A portal that connects but answers slowly still returns a real answer, so those checks do not fail open and get cached as allowed for an hour. On a test instance, a black-holed connection gave up after 2.0 seconds instead of 10.0, and a portal answering after 5 seconds returned its answer where the previous version of this MR failed open at 4.0. The per-IP-family figure comes from reading the code; the test used one IPv4 address.

How a cold-cache check ends

flowchart TD
    A["Ai::UsageQuotaService<br/>cache is cold"] --> B["verify_usage_quota<br/>HEAD api/v1/consumers/resolve"]
    B --> C{"Connection to the portal"}
    C -->|"hangs"| D["Gives up on the connection<br/>before: at least 10 s per IP family<br/>now: about 2 s per IP family"]
    D --> E["Fails open<br/>cached as allowed for an hour"]
    C -->|"opens, answer is slow"| F["Read waits up to 20 s<br/>unchanged by this MR"]
    F --> G["Real answer"]
    C -->|"opens, answer is fast"| G

References

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/627285

Screenshots or screen recordings

Not applicable: no UI change.

How to set up and validate locally

1. bundle exec rspec ee/spec/lib/gitlab/subscription_portal/clients/rest_spec.rb: 292 examples, 0 failures.
2. bundle exec rspec ee/spec/services/ai/usage_quota_service_spec.rb: 34 examples, 0 failures.
3. bundle exec rubocop ee/lib/gitlab/subscription_portal/clients/rest.rb ee/spec/lib/gitlab/subscription_portal/clients/rest_spec.rb: 2 files inspected, no offenses.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

This MR was prepared with assistance from Claude Code.