[PM-40210] Add single + bulk PAM enable flows for AccessPam

[Hinton]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-40210

📔 Objective

The member-management flows that grant and revoke AccessPam, the admin-controlled per-member PAM access grant. Both paths are plain field writes behind an org-level UsePam check.

Worth flagging for review:

• No seat logic anywhere. PAM has no seats, so there is deliberately no analogue of the SM pattern — no CountNewSmSeatsRequiredQuery, no UpdateSecretsManagerSubscriptionCommand, no autoscale-last ordering rule. The story's earlier AllocatePamSeats version is superseded.
• Why an explicit UsePam guard. SM has no explicit check in these flows; it leans on CountNewSmSeatsRequiredQuery throwing "Organization does not use Secrets Manager" as a side effect of counting seats. With no seat count to piggyback on, PAM checks UsePam directly — otherwise AccessPam = true on a non-PAM org is inert but unvalidated, since claim emission ANDs the two (PM-40209), and the admin gets a silently ineffective toggle instead of an error.
• Only the grant is gated. Revoking access is not checked against UsePam, so removing a member's access stays possible on an org whose entitlement has lapsed. Editing a member who already holds access is likewise not a grant.
• Both sides of the flag. The single-user path is implemented in both the v1 command and the v2 command behind ChangeMemberEmailNoMp, so the toggle behaves identically whichever serves the request. v2 gets an IsEnablingPam() transition helper and a typed PamNotEnabled validator error; v1 guards inline with the other validation.
• Bulk endpoint is PUT organizations/{orgId}/users/enable-pam, mirroring BulkEnableSecretsManagerAsync minus the seat block. SM's obsolete PATCH alias is not replicated, and like SM's bulk path it logs no events (breakdown review note 5).

UpdateOrganizationUser gains an accessPam parameter; its only production caller is the v2 command.

Depends on #8160 (claims plumbing) — review that first.

[codecov]

Codecov Report

❌ Patch coverage is 96.77419% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 67.53%. Comparing base (76f8d09) to head (b937e2f).

Files with missing lines	Patch %	Lines
...Console/Controllers/OrganizationUsersController.cs	94.11%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@                        Coverage Diff                         @@
##           pam/claims-permission-plumbing    #8161      +/-   ##
==================================================================
+ Coverage                           63.06%   67.53%   +4.47%     
==================================================================
  Files                                2315     2315              
  Lines                              100530   100561      +31     
  Branches                             9045     9052       +7     
==================================================================
+ Hits                                63395    67910    +4515     
+ Misses                              34945    30364    -4581     
- Partials                             2190     2287      +97     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Hinton]

I guess we could technically skip this check as enabling pam for a user without it being enabled in the org does nothing. I'll leave it up to AC to decide if it's worth keeping. It would eventually be replaced by the billing seat logic.