Give Orbit access to groups with a sales-assisted trial

What does this MR do and why?

When Sales starts an Orbit trial in CustomersDot, an Owner can turn Orbit on, but the group stays in the "being indexed" state. Under the promo access gate, only a trial enrollment row gives a group access, and only the self-serve trial start writes that row.

• When an Owner turns Orbit on during an active trial, GitLab now records the trial enrollment. A beta enrollment becomes a trial enrollment.
• When the trial ends in CustomersDot, the hourly ended-trials cron turns Orbit off, as it does for self-serve trials.
• GitLab Dedicated and GitLab Self-Managed instances need no change: they read the trial status from CustomersDot.

Groups already turned on without the row are turned off by the hourly cron. The Owner can then turn Orbit on again.

References

Closes https://gitlab.com/gitlab-org/gitlab/-/issues/635694

Screenshots or screen recordings

E2E run of the Orbit monetization factory, new scenario S2.5. Sales funds the Orbit trial wallet in the local CustomersDot, and GitLab does not start a trial. Then the Owner turns Orbit on with the real toggle service. Before: master. After: this branch.

	Before	After
Group Orbit settings after the Owner turns Orbit on
Status tab after the Owner turns Orbit on

Check	Before	After
Orbit on	yes	yes
Trial enrollment	none	trial
Index status	not started	indexed
/api/v4/orbit/query for the Owner	blocked	returns the group's project

Video before (master)

Video after (this branch)

GitLab Dedicated and GitLab Self-Managed

Scenario M2.2: Sales funds the Orbit trial of the instance in CustomersDot, then the Owner turns Orbit on for a group. The instance reads its trial from CustomersDot, so it needs no enrollment row. It works on master and on this branch, and the run below is on this branch.

Status tab	Admin GitLab Orbit page

Video (this branch)

Regression: the existing turn-on scenarios S2.4, S3.1, M2.1, M3.4, and M4.1 also pass on this branch.

How to set up and validate locally

1. Enable orbit_promo_access_gate and orbit_trial for a top-level group on a SaaS GDK, with an active Orbit trial in CustomersDot and no trial started from GitLab.
2. As the Owner, turn on Orbit on the group's Orbit settings page.
3. In the Rails console:

   group.reload.orbit_namespace_enrollment.source # => "trial"
   Analytics::Orbit::Billing.account_for(group).entitled? # => true

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.