Exclude sandbox projects from credential's project list

[hirad121]

Description

Excludes sandbox projects from a credential's "Projects with access" list
on the Settings > Credentials page. Credentials automatically propagate to
descendant sandboxes so runs there keep working, but that full propagation
tree was being shown in this list, including sandboxes already merged and
deleted. The list now shows only the top-level projects the credential is
actually granted to.

Closes #4014

Validation steps

1. Create a project, grant a credential access to it.
2. Provision a sandbox off that project.
3. Go to Settings > Credentials — the sandbox no longer appears in the
   credential's "Projects with access" list; the parent project still does.
4. Existing API behavior for querying a sandbox's own credentials directly
   (GET /api/projects/:sandbox_id/credentials) is unaffected — that's a
   different, intentional code path and was verified unchanged.

Additional notes for the reviewer

This only touches the display list in
CredentialIndexComponent.list_credentials/1. It doesn't touch
Credentials.list_credentials/1 (the shared context query used by the API),
the sandbox-propagation logic, or any authorization checks — full
credential and API test suites pass unchanged.

AI Usage

• I have used Claude Code
• I have used another model
• I have not used AI

Pre-submission checklist

• I have performed an AI review of my code
• I have implemented and tested all related authorization policies
• I have updated the changelog
• I have ticked a box in "AI usage" in this PR