GitLab agent for K8s ci_access sharing does not work across top level groups
## Problem to solve
On self-managed instances, sharing a registered agent across the whole instance should be possible.
## History
This is a follow-up issue of https://gitlab.com/gitlab-org/gitlab/-/issues/346566+
Originally, the agent had to be a direct descendant of the group where the shared projects lived. We lifted this restriction as part of https://gitlab.com/gitlab-org/gitlab/-/issues/346566+, but it's still required that the agent and the shared projects have a common top-level root group.
## Proposal
```
gitlab.example.com/
|- infra-group/infra-project
| |- my-agent
|- dev-group/app-project
```
`my-agent` can be shared with the `dev-group` and all its project.
Make it possible to enable/disable this feature to support large installations when the feature would cause a security or compliance risk.
Use the same admin setting that controls organization-level sharing (added in https://gitlab.com/gitlab-org/gitlab/-/issues/357516) to enable/disable this functionality.
### Related
- https://gitlab.com/gitlab-org/gitlab/-/issues/346566+
issue