Add execute_rbac_scope_binder_partial for conflict-safe idempotent scope binding

Add a new execute_rbac_scope_binder_partial() function that handles unique constraint conflicts gracefully, complementing the existing execute_rbac_scope_binder().

Background:

- execute_rbac_scope_binder() uses execute_bulk_creator (add_all + flush) for business rows, which raises IntegrityError on unique constraint violation

- RBAC association rows already use on_conflict_do_nothing, but business rows do not

- Callers (scaling_group, container_registry, group) must pre-filter duplicates before calling scope binder

- rbac/utils.py has bulk_insert_on_conflict_do_nothing but scope binder doesn't use it

Proposed approach:

- Create execute_rbac_scope_binder_partial() in repositories/base/rbac/scope_binder.py

- Step 1: Use execute_bulk_creator_partial (savepoint per row) instead of execute_bulk_creator

- Step 2: Only create RBAC association rows for successfully inserted business rows, using error indices to filter:

failed_indices = {e.index for e in bulk_result.errors}

successful_pairs = [p for i, p in enumerate(binder.pairs) if i not in failed_indices]

- Return type should include both successes and skipped/failed info

API separation:

- execute_rbac_scope_binder: existing, bulk insert, fast, caller must ensure no conflicts (no changes)

- execute_rbac_scope_binder_partial: new, savepoint per row, conflict-safe, idempotent

Trade-off: N savepoints overhead vs caller simplicity. Acceptable for small N (e.g. user assignment), callers with large N or guaranteed uniqueness should use the existing bulk API.

File: src/ai/backend/manager/repositories/base/rbac/scope_binder.py

JIRA Issue: BA-5488