docs(specs): bring LookupResources into S25's consumed set

S25 said LookupResources was a paginated UI/admin scan off the authorization path that this client does not consume. Issue #969's step MRs make the client drain it on the repository-listing denied branch, so that claim goes stale.

Corrects four sites: API Contracts, the Out of Scope entry, and the two telemetry claims that bound the rpc label set. Each names the condition and the event, so it reads correctly either side of those MRs. The mechanism stays in S09's Repository listing section, cross-referenced rather than restated.

Pairs with the #969 step MRs and can merge before or after them.

Related to https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/969