Add grants support for AI Gateway securables (model_service, mcp_service, model_provider_service)

[alex-khakhlyuk]

…ice, model_provider_service)

Follow-up to the #6410 split. Wires UC grants (the grants field + .grants sub-resource) into all three AI Gateway securables, mirroring volumes/registered_models: the Grants field on each resource config, the resource->securable_type mapping (model_service/mcp_service/ model_provider_service), and the direct-engine grants sub-resource registration. Stacked on the model_provider_service branch.

Changes

Why

Tests

[eng-dev-ecosystem-bot]

Integration test report

Commit: 4be86b3

Run: 34886557896

	Env	❌​FAIL	🟨​KNOWN	✅​pass	🙈​skip	Time
❌​	aws linux	4	1	281	393	8:04
❌​	aws windows	4	1	283	391	9:15
❌​	azure linux	4	1	280	393	7:46
❌​	azure windows	4	1	282	391	13:14
❌​	gcp linux	4	1	281	393	8:08
❌​	gcp windows	4	1	283	391	11:00

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
🟨​	TestAccept	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K
❌​	TestAccept/bundle/resources/mcp_services/lifecycle	❌​F	❌​F	❌​F	❌​F	❌​F	❌​F
❌​	TestAccept/bundle/resources/mcp_services/lifecycle/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌​F	❌​F	❌​F	❌​F	❌​F	❌​F
❌​	TestAccept/bundle/resources/model_provider_services/lifecycle	❌​F	❌​F	❌​F	❌​F	❌​F	❌​F
❌​	TestAccept/bundle/resources/model_provider_services/lifecycle/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌​F	❌​F	❌​F	❌​F	❌​F	❌​F