#3777 feat(discover): limit discovery to the current organization

Closes #3776

Spec: Spec issue-3776: Single-organization referrer discovery ships in this PR, together with its implementation (R-001, R-004, R-005, D-001 to D-003, D-005).

We would like two reviewers to approve this spec before it merges.

Referrer discovery searched every organization of a logged-in user. It was the only operation that crossed organization boundaries, and the result of a policy that called it depended on the credential. This PR makes discovery single-organization by design, as new control plane behavior:

• Control plane: discovery covers only the current organization, for users and API tokens (R-001, R-005). The organization is resolved like for any other endpoint, from the org header or the user's default membership, and the org middleware checks access (D-002). Project visibility is the caller's visibility in that organization only.
• Clients: no change (D-003). chainloop discover, the chainloop.discover policy builtins (Rego and WASM) and the web UI get the new behavior from the control plane (R-004). An older control plane keeps its behavior until it is upgraded.
• The opt-in current_org_only request field and the chainloop.discover_current_org builtin of the first design of this PR are removed before release (D-001, D-005).

Behavior change: a script that relied on cross-organization discovery with a user session now gets the result of the selected organization only.

AI disclosure: this contribution was made with the help of Claude Code.