Fallback to admin KUBE_TOKEN for project clusters only

What does this MR do?

We do not want group level clusters to fall back to what was old behaviour for project level clusters. So instead we will not return any KUBE_TOKEN if we cannot find a suitable kubernetes_namespace for the project, in the group level cluster case.

Add test cases to assert above

Split off from https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/22308 - required for group clusters to work as a whole

What are the relevant issue numbers?

#34758 (closed), #53592 (closed)

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• [-] Documentation created/updated
• Tests added for this feature/bug
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• [-] Conforms to the style guides
• [-] Conforms to the database guides
• [-] Link to e2e tests MR added if this MR has Requires e2e tests label. See the Test Planning Process.
• [-] Security reports checked/validated by reviewer