Model changes to support enabling duo feature through namespaces at instance level

What does this MR do and why?

Model changes to support enabling duo feature through namespaces

Using namespace ownership to verify whether a user has access to a specific duo feature allows customers to perform internal staggered rollouts within their organizations, for self-managed.

Right now, as described in https://gitlab.com/groups/gitlab-org/-/epics/20241, the accessible entities have high scope (classic duo, duo agents or duo flows), but the approach is flexible to new entities like foundational agents or other settings.

EE: true

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #583896