REST: Fix scope of GET /projects/:id/runners endpoint

What does this MR do and why?

Describe in detail what your merge request does and why.

In the GET /projects/:id/runners REST API endpoint, we're not taking the setting (see screenshot) that controls whether group runners are shared with child projects, and are therefore potentially returning runners that the user doesn't have access to.

This MR fixes the Ci::Runner.owned_or_instance_wide scope so that it doesn't return group runners unless project.group_runners_enabled? is true.

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

Setting	Result
Enabled:
Disabled:

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

Assuming you have a local GDK setup with some group runners and project, you should be able to see them from the project, issuing a REST call such as:

$ xh http://gdk.test:3000/api/v4/projects/8/runners\?type=group_type PRIVATE-TOKEN:$GITLAB_GDK_TOKEN

If you then visit the project CI/CD runners page (http://gdk.test:3000/h5bp/html5-boilerplate/-/settings/ci_cd#js-runners-settings) and disable the group runners, the same request should return an empty collection.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Closes #351758 (closed)