Apply a container registry's allowed projects only after the update is accepted

ContainerRegistryAdapter.admin_update writes the allowed-project links before it updates the registry row, and the two run in separate transactions. When the update is then refused the links stay changed, so a caller that sees a failure has had half of its request applied.

## How it goes wrong

- Send an update that changes the allowed projects and sets a URL with no host.
- The links are written; the update is refused with InvalidContainerRegistryURL.
- The caller is told the call failed, and the project links are different from before.

## Expected

A refused update leaves the registry and its links as they were. admin_create already applies the links after the row is created; admin_update is the one that does it the other way round.

## Acceptance

- A refused update leaves the allowed projects unchanged.
- A scenario row covers it, in the shape adapters/container_registry/KNOWLEDGE.md uses.

JIRA Issue: BA-7857

Start at ContainerRegistryAdapter.admin_update and compare its transaction and allowed-project handling with admin_create. Read adapters/container_registry/KNOWLEDGE.md for the scenario format, then run the relevant container-registry scenarios. Done means a refused update with an invalid URL leaves the registry's allowed projects unchanged and the new scenario covers that case.

Written by the indexing model from the issue text.