Delete the project to user scope bindings already written to existing databases

The project to user cascade bindings created by member enrollment must be removed from existing databases. Two sources wrote them: the enrollment path at runtime, and the virtual-scope backfill migration, which derived scope bindings from the legacy scope associations for entity type user across scope types domain and project.

### Scope

- Add an Alembic revision that deletes the stale bindings.
- Delete only bindings whose bound scope is a project and whose anchor virtual scope belongs to a user. Bindings from a project into a container registry or a resource group virtual scope are intended cascades and must survive.
- Keep the revision idempotent, per the repository migration policy.

### Notes

- No backport is needed: the backfill revision that produced these rows is not contained in any release tag or release branch.
- The original backfill revision does not need editing. A fresh install runs it against an empty legacy association table and inserts nothing, so only upgrade paths produce the rows, and this revision follows them in order.
- This must land before the wider virtual-scope membership backfill writes ordinary resource entities into entity memberships, which is what turns the stale bindings from latent into an actual permission leak.

JIRA Issue: BA-7367

Start by reading the existing Alembic revision that created the virtual-scope backfill and the enrollment path that wrote the bindings. Trace the binding and virtual-scope relationships, then verify the new revision is idempotent, removes only project-to-user bindings, and preserves project-to-container-registry and project-to-resource-group cascades.

Written by the indexing model from the issue text.