Send the Cloud Connector instance uid in the Orbit JWT

What does this MR do and why?

On self-managed and Dedicated, CustomersDot cannot attribute Orbit billing events to a subscription. The Orbit token Rails sends to Orbit carries the instance-derived UUID as unique_instance_id, but CustomersDot resolves self-managed usage only by the instance uid it issued in the Cloud Connector token, so every Orbit event fails enrichment with Missing source for event.

This MR makes the Orbit token send the Cloud Connector token's gitlab_instance_uid instead, the same rule the billing events client already uses for Secrets Manager. The claim reader moves into CloudConnector::Tokens so both share it. GitLab.com is unchanged.

References

• Related to https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/1229
• Same fix for Secrets Manager billing events: !256332 (merged)
• CustomersDot-side fallback for the same mismatch: https://gitlab.com/gitlab-org/customers-gitlab-com/-/merge_requests/17198

Screenshots or screen recordings

Not applicable: no UI changes.

How to set up and validate locally

Prerequisites: GDK as self-managed (GITLAB_SIMULATE_SAAS=0, license_mode: test) with an online cloud license activated against a CustomersDot, so a Cloud Connector token exists.

1. In the Rails console, check the token's uid differs from the instance-derived UUID:

   CloudConnector::Tokens.cloud_connector_instance_uid  # => CustomersDot-issued uid
   Gitlab::GlobalAnonymousId.instance_uuid              # => a different, instance-derived UUID

2. Generate an Orbit token and confirm it carries the CustomersDot-issued uid:

   jwt = Analytics::KnowledgeGraph::JwtAuth.generate_token(
     user: User.find_by(username: 'root'),
     request_context: Analytics::KnowledgeGraph::RequestContext.new(source_type: 'rest')
   )
   JWT.decode(jwt, nil, false).first['unique_instance_id']
   # => equals CloudConnector::Tokens.cloud_connector_instance_uid

3. Optional, end to end: run Orbit with billing pointed at Snowplow Micro and the quota check at your CustomersDot (billing.auth_mode: cloud_connector, billing.quota.auth_mode: license_checksum), then send POST /api/v4/orbit/query. The billable_usage event in Snowplow Micro and the HEAD /api/v1/consumers/resolve request both carry the CustomersDot-issued uid.

4. Optional: insert that event into CustomersDot's raw_billing_usage_events and run Billing::Usage::EnrichmentService. It resolves to the subscription; with the old value it logs Missing source for event.

5. Run the specs:

   bin/rspec ee/spec/lib/cloud_connector/tokens_spec.rb \
     ee/spec/lib/analytics/knowledge_graph/jwt_auth_spec.rb \
     ee/spec/lib/ee/gitlab/billing_events/client_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to gitlab-org/orbit/knowledge-graph#310 (closed)