[PM-25379] Refactor org metadata

[kdenney]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-25379

📔 Objective

Note: this is a copy of PR #6418 as that one had to be reverted because it was merged too early. This PR will not be merged until the clients PR is also merged.

---

This work was a refactor, so no functional or visual changes should be present. Note: these changes are only applied with the feature flag pm-25379-use-new-organization-metadata-structure

Here’s a list of changes made for this issue.

1. All properties that were not being used anywhere in clients were removed from the models.
2. The cloud-hosted organization subscription page:
   1. This page used to look at the organization metadata (provided by the server API) to determine if it should show the self hosting section. The property checked was isEligibleForSelfHost. This was updated to instead simply check that the org’s plan tier is either families or enterprise and the matching property was removed from the metadata models. (This is equivalent to the logic used by the server API before, but does not require any additional data to be fetched.)
   2. This page also used isManaged in org metadata to switch between two variations of UI for the “manage subscription” section. This was updated to instead use hasBillableProvider which the client already has access to on the org object and the property was removed from the metadata models. The UI switches:
      1. When the org is managed by a consolidated billing MSP.
      2. When the org is not managed by a consolidated billing MSP.
3. The organization members page uses organization metadata fetched from the API in the following cases:
   1. isOnSecretsManagerStandalone is used to force the secrets manager access checkbox when inviting a new member or editing an existing member.
   2. occupiedSeatCount is used in the following cases:
      1. to restrict inviting additional members if the seat limit is reached
      2. to show the remaining seats on the invite dialog
4. The member access report uses metadata simply to pass it along to the edit member dialog for the same usage as above when editing an existing member.

This PR is of course the server-side changes. It includes the new feature flag, removing of unused properties, refactoring the GetMetadata function into a new query class, and a new vnext endpoint to use that query.

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – 05b4e2ad-d6f9-4a4d-8a40-6caa792b6e23

New Issues (1)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	Use_Of_Hardcoded_Password	/src/Core/Constants.cs: 145	details The application uses the hard-coded password CipherRepositoryBulkResourceCreation for authentication purposes, either using it to verify users' id... ID: IpzRCs6K073h%2F5Gz4YJ%2BlZY%2Fwlg%3D Attack Vector

Fixed Issues (4)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CSRF	/src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 108
	CSRF	/src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 96
	CSRF	/src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 60
	CSRF	/src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 50