Prioritize Duo Enterprise add-ons over Pro in ProvisionService

What does this MR do and why?

Resolves https://gitlab.com/gitlab-org/gitlab/-/issues/494327+. Fixes a bug where there's ambiguity regarding which Duo add-on tier is returned from GitlabSubscriptions::AddOnPurchases::GitlabCom::ProvisionService. The correct logic is to always prioritize Duo Enterprise add-ons over Duo Pro, which this MR does.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

No visual changes expected.

How to set up and validate locally

1. Start GDK
2. Create a new group. Note the group ID.
3. Enter the Rails console.
4. Create two add-on purchase entries to test with:

GitlabSubscriptions::AddOnPurchase.create!(
  subscription_add_on_id: GitlabSubscriptions::AddOn.where(name: "code_suggestions"),
  namespace_id: Namespace.find(<group_id>),
  quantity: 2,
  started_at: Date.today,
  expires_on: 1.year.from_now,
  purchase_xid: "A-S00000001"
)

GitlabSubscriptions::AddOnPurchase.create!(
  subscription_add_on_id: GitlabSubscriptions::AddOn.where(name: "duo_enterprise"),
  namespace_id: Namespace.find(<group_id>),
  quantity: 2,
  started_at: Date.today,
  expires_on: 1.year.from_now,
  purchase_xid: "A-S00000001"
)

3. Confirm that the Duo Enterprise add-on purchase is returned from the following call:

GitlabSubscriptions::Duo.enterprise_or_pro_for_namespace(Namespace.find(<group_id>))