Use the Orbit promo gate for billing namespace candidates

What does this MR do and why?

Under the orbit_promo_access_gate flag, a group gets Orbit from the orbit_promo add-on or a trial, not from Premium or Ultimate. The billing namespace candidates now follow the same rule. Without it, a Free group with the add-on or a trial group has no billing namespace.

With the flag on, these groups send a root_namespace_id, so the Knowledge Graph service checks their quota and bills them.

With the flag on or off, a user can only pick a group where they are Reporter or higher, the same rule as Orbit access. Before, a Guest, Planner, or project-only member could pick a paid group they cannot query, and a Reporter of only a subgroup could not pick its root.

References

https://gitlab.com/groups/gitlab-org/-/work_items/23874

Screenshots or screen recordings

N/A (backend only)

How to set up and validate locally

1. Run GDK with GITLAB_SIMULATE_SAAS=1.

2. Take a Free top-level group with Orbit on and the orbit_promo add-on (see !260830 (merged)), and a member of it.

3. In a Rails console:

   finder = Analytics::KnowledgeGraph::GoverningNamespaceFinder.new(user)
   finder.candidates # => []
   Feature.enable(:orbit_promo_access_gate, group)
   finder.candidates # => [group]

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.