Add ContainerRegistryDomainEntityUnbinder and ASE binder helpers for domain scope

## Description

Add a domain-scoped unbinder that mirrors the existing `ContainerRegistryProjectEntityUnbinder`, and helpers for binding domain ↔ container registry pairs into `association_scopes_entities` via the RBAC framework.

## Implementation

- Add `ContainerRegistryDomainEntityUnbinder` to `repositories/container_registry/scope_binders.py`.
- Configure `entity_type = RBACElementType.CONTAINER_REGISTRY` and `scope_ref = RBACElementRef(RBACElementType.DOMAIN, domain_name)`.
- Because the domain side has no business junction table, `build_purger_spec` removes only the ASE row.
- Expose a small helper for assembling the `RBACScopeBinder` pair used by domain create/update flows.

## Success Criteria

- Unbinder conforms to the `RBACScopeEntityUnbinder` interface and integrates with `execute_rbac_scope_binder` / `execute_rbac_scope_entity_unbinder`.
- pants lint/check passes for the affected packages.

JIRA Issue: BA-5786