Derive the RBAC possible/impossible catalog from actions and remove VALID_SCOPE_ENTITY_COMBINATIONS

Replace the hand-written VALID_SCOPE_ENTITY_COMBINATIONS with a dataclass derived from actions, combining scope reachability (scope actions) and per-entity operations (single-entity actions); route rbac_scope_entity_combinations / permission matrix GQL through it. Operations present on a single-entity action but absent from the scope action must still be included as possible. Depends on action normalization (BA-6285). Part of BEP-1062 (#12842) section 2.6/3.(f).

Success Criteria
- [ ] An action-derived dataclass produces the scope->entity possible/impossible catalog by combining scope reachability and per-entity operations
- [ ] Operations present on a single-entity action but absent from the scope action are still included as possible
- [ ] VALID_SCOPE_ENTITY_COMBINATIONS removed; GQL exposure routes through the dataclass
- [ ] pants test passes for affected packages

JIRA Issue: BA-6878

Start by locating rbac_scope_entity_combinations, the permission matrix GraphQL exposure, VALID_SCOPE_ENTITY_COMBINATIONS, and the action definitions; review the action normalization dependency BA-6285 first. Implement and test the action-derived dataclass so it combines scope reachability with single-entity operations, then run pants tests for the affected packages and confirm the legacy constant is removed.

Written by the indexing model from the issue text.