#972 Feat(project): the project as tenant for queries, definitions and configs (20/21)

Stack 20/21 · after #971 · next #973

Targets main but builds on #971, so the earlier stack commits show here too: review the last commit only. Merge after #971.

Description of your changes

The project becomes the tenant boundary:

• VelaQL runs in the picked project, as its user, read-only.
• Definitions: a project has its own definitions beside the global ones, and every page and picker says whose it offers.
• Configs: a Configs page under Delivery lists the project's configs; templates are grouped as project or global.

Fixes #

I have:

• Read and followed KubeVela's contribution process.
• Related Docs updated properly. In a new feature or configuration option, an update to the documentation is necessary.
• Run yarn lint to ensure the frontend changes are ready for review.
• Run make reviewableto ensure the server changes are ready for review.
• Added backport release-x.y labels to auto-backport this PR if necessary.

Special notes for your reviewer

• Global definitions and configs stay in vela-system; a project's live in its namespace.
• A view may import vela/ql, vela/op and CUE's own packages. vela/op stays because KubeVela's own application-revision-view uses it for op.#Read; inside a view it can only read.