Fix the conditions when we scope to gitlab-org

🌀 Context

We're currently implementing a data migration on the Container Registry. This migration is going to be driven by the rails backend. For all the nitty-gritty details, see &7316 (comment 897867569).

Rails being the driver, this allows us to use a nice collection of feature flag to control several aspects of the migration such as throughput or the speed.

One of those aspects is limiting the eligible image repositories to those in the gitlab-org root namespace. This feature flag will basically tune the image repository SQL query to consider only those in that root namespace.

The problem is that the conditions stated: any namespace which path is gitlab-org. This select way too many namespaces because it can include "sub" namespaces (or better said sub groups) that are named gitlab-org. In other words, the current scope can select gitlab-org/foo, gitlab-org/foo/bar but also foo/gitlab-org/bar and foo/bar/gitlab-org/bananas.

This is issue #359078 (closed). This MR aims to fix this using the right conditions in the scope.

🔍 What does this MR do and why?

• Update EE::ContainerRepository.with_target_import_tier class function to properly behave when ::ContainerRegistry::Migration.limit_gitlab_org? is enabled.
  • First find the root namespace with path gitlab-org.
  • From there, use a similar approach to the ContainerRepository.for_group_and_its_subgroups scope to select the image repositories of that namespace.
    • I say similar because we really want to get the image repositories even if the project feature registry has been disabled.
• Update the related spec.

🖥 Screenshots or screen recordings

n / a

⚙ How to set up and validate locally

1. Create a dummy root group.
2. Create a sub group gitlab-org.
3. Create a project in that sub group.
4. Create a dummy container repository under the root gitlab-org group:

   FactoryBot.create(:container_repository, project: Project.first)

5. Create another dummy container for project created in (3.):

   FactoryBot.create(:container_repository, project: Project.find(<project_id>))

6. Update EE::ContainerRepository.with_target_import_tier to disable the 2 first guards:

   override :with_target_import_tier
   def with_target_import_tier
     # self-managed instances are singlular plans, so they do not need
     # these filters
     # return all unless ::Gitlab.com?
     # return all if ::ContainerRegistry::Migration.all_plans?
     ...

7. Check the with_target_import_tier scope
   • On master, both dummy images from (4.) and (5.) are returned.
   • With this MR, only image from (4.) is returned.

🚥 MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

💽 Database review

• ContainerRepository.ready_for_import.take