refactor: add new label package

[AlirieGray]

Closes #18105

This PR adds the new label service to conform to the pattern established in the tenant and authorization services, where the http, middleware, service, and storage code is contained in the same package.

It also makes a couple of incidental changes, such as moving Metrics helper functions from the tenant and authorization packaged to their own file in kit (this could be moved somewhere else if there's a better place). Also changing CreateUserResourceMappingForOrg in kv from private to public (this can be changed back once URMs are removed from the Label Service).

The KV Service passed to the new Label Service can also be removed once URMs are removed from the Label Service.

Next step will be to put this code behind a feature flag and incrementally test.

• Rebased/mergeable
• Tests pass

[GeorgeMac]

This PR is awesome 🎉 Thanks for the helpful description as well and the comment on orgID. That got my mental cogs turning :D

I mention a couple of things which I think need addressing. I see we used to use an org service to do a find org for resource lookup, in order to authorize. This is hard to maintain and I also want to see it go. I am not certain the orgID threading here is going to work though, unless I am missing something. So perhaps we can hash it out later today.

[GeorgeMac]

One little thing around responsibility. The crux being I think Store or storage layers should handle uniqueness constrains, like unique names. Services should just delegate to storage or talk to other services and so on.
Other than that I think this PR looks awesome. Happy to discuss that point and I will make sure to stick around and get it all cleared up so you can ship this today 👍

[GeorgeMac]

I feel like this logic should live in Store and the *label.Store.UpdateLabel should take the LabelUpdate.
Meaning all Service does is open a transaction and pass the right things down to storage.
My concern here is that after updating the name, we could fail validation of the label or fail to actually put the label, which is all store.UpdateLabel is doing at the moment.
This would also reduce this function down to 1 transaction instead of opening 3.
So you could get a non-successfull call to this service to update the label, but the name did change successfully.

[GeorgeMac]

Awesome stuff 🎉