* decrypt and read values from airgap token

- Adds notion of "AirgapToken"
- Adds max-users and company optional fields to `TokenStatus`
- Adds branch to `fetch-token-status*` for handling airgapped tokens

* Add support for handling airgap tokens

- validate airgap token valid-thru date

* enforce user creation limits using airgap token

* fix airgap token reads + fill in the token data

* in oss mode don't try to read the airgap_ token

* use airgap-token? helper

* tighten the user-creation logic

- make the check correct
- account for archived users

Co-authored-by: John Swanson <john.swanson@metabase.com>

* check airgap user count

setting premium-embedding-token
app startup

* move decryption code into ee namespace

* add some tests for token decryption

* fix tests and add tests

* move ee features into ee tests

* add typehint + warn on reflection

* add a check for missing public key resource

* respond to review

- add docstring to AirgapToken
- remove outdated comment
- fix off-by-1 error

* valid-now? takes a TokenStatus instead of a :map

* revert usage of mt/with-temporary-setting-values

---------

Co-authored-by: John Swanson <john.swanson@metabase.com>