Add organization_id to container registry token metadata

What does this MR do and why?

Closes #598222

The container registry needs to know which organization a repository belongs to, so it can route requests in Cells. Now every registry token GitLab issues includes the project's organization_id. It sits next to the project path, project ID and top-level namespace ID that the token already has.

This covers the tokens users and CI jobs get when they log in to the registry. It also covers the tokens GitLab uses itself, for example to manage tags and for Geo. It adds no database query.

The registry side is tracked in container-registry#2185 (closed) and deploys separately. As the issue says, the registry treats a missing field as a zero value. So the order of the two deploys doesn't matter, and I didn't add a feature flag.

I left one case out on purpose. The two tokens GitLab uses to rename or move repositories in the registry still don't get organization_id. They don't carry the project ID or namespace ID today either, so I kept them the same. If the registry team needs it there too, I can add it.

I added the new field to every existing token check. I also added a check that a project in its own organization gets that organization's ID, not the default one. The registry auth tests ran in pipeline 2933434639. rspec unit predictive (679 examples) and rspec-ee unit predictive (1428 examples) both passed with 0 failures. rubocop passed too. Locally I only ran ruby -c on the two changed files. I couldn't decode a real token by hand because I don't have GDK.

References

• Issue: #598222
• Registry side: container-registry#2185 (closed)
• Background: #596900 (closed)

Screenshots or screen recordings

Not applicable. This is a backend change to the token payload, with no UI change.

How to set up and validate locally

1. Enable the container registry in GDK.
2. In the Rails console, issue a pull token for a project and decode it:

   project = Project.find_by_full_path('flightjs/Flight')
   token = Auth::ContainerRegistryAuthenticationService.pull_access_token(project.full_path)
   JWT.decode(token, nil, false).first['access'].first['meta']

3. The meta hash should include "organization_id" with the same value as project.organization_id.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Implemented with AI assistance; I reviewed and tested the changes.