Show the vulnerability page CTA only where secrets manager is offered

What does this MR do and why?

This MR applies the following changes:

• The secrets manager page 404s when the top-level group opts-out (disabled), so the current CTA leads to a dead link in this scenario. This updates the link to the secrets manager settings so the Owner can re-enable. For non-owners, they are led to the existing "Request secrets manager" flow.
• If the secrets manager is NOT offered (e.g. we don't offer to personal namespace projects, or if the license/feature flags are disabled), we don't show the CTA
• Applies some refactoring to the code from suggestions in the previous MR

References

Follow up to !258447 (merged)

Screenshots or screen recordings

Opted Out (before)	Opted out (after)

When opted-out and the user is not the owner, they are funneled into the request flow.

How to set up and validate locally

1. Follow the validation steps in !258447 (merged)
2. For the TLG Owner, opt-out of the secrets manager by going to Settings > Secure and disabling the secrets manager
3. Visit the vulnerability page and verify that the CTA now links to the settings page

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.