Add flag to resolve project access from memberships

What does this MR do and why?

• This is an experiment behind the resolve_project_access_from_memberships feature flag (per user, default off). It only changes direct access checks, where we check one user's access to a specific project. Searches and lists that decide which projects a user can see still use project_authorizations.
• Adds the feature flag so the new membership-based lookup can be rolled out gradually.
• The flag is read once per user per request. The source (memberships or project_authorizations) is recorded in the request log as authz_project_access_source, even when lookups are answered from the request cache.
• This lets us compare authz_* timings between users with the flag on and off.
• Nothing uses the flag yet. The rollout issue is not created yet.

References

• Work item: https://gitlab.com/gitlab-org/gitlab/-/work_items/632453
• Builds on: !263757 (merged)

Screenshots or screen recordings

Not applicable, no UI changes.

How to set up and validate locally

1. Open a Rails console and pick a user.
2. Run Authz::UserProjectGrants.enabled_for?(user.id). It should be false.
3. Run Feature.enable(:resolve_project_access_from_memberships, user).
4. Run Authz::UserProjectGrants.enabled_for?(user.id) again. It should be true.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.