Allow admins to set which groups can use AI governance features (and limits)

> [!NOTE]
> This issue is a part of our larger **AI Governance Add-On**: [PRD](https://www.notion.so/coderhq/AI-Governance-Add-On-2ced579be592801eac50c83982a0fa49). See the [GitHub Project](https://github.com/orgs/coder/projects/84/views/2) for all related issues.

With the AI Governance Add-On supporting a subset of the total seats within a deployment, admins will clearly want to be able to control which groups can use AI features.

## Requirements

Seat usage:

- [ ] **Enable AI Governance per Group**: In the group settings page, an admin should tick "Enable AI Governance" (default off, except for the "Everyone" group which is default: on) to allow a group to access AI governance features.
- [ ] **Admin visibility**: In the licensing page, where it shows total usage per license (#1228), it should break down per group on # of users entitled (based on group) and # of users consuming the usage

Enforcement:

- [ ] **Group Membership**: If the user is not a part of any group (including Everyone) that allows access to AI Governance, they should see an error when authenticating to AI Bridge.

## Out of scope

- Fine-grained controls for who can have Agent-Ready Workspace starts (and how many)