fix(access-control): complete gate access-rule option lists (NPPD-2135)

[adekbadek]

All Submissions:

• Have you followed the Newspack Contributing guidelines?
• Does your code follow the WordPress coding standards and VIP Go coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

The gate editor's Paid Access pickers could not offer every value a gate may legitimately hold.

Institutions were fetched at a fixed page size of 100, so a site with more than that could not select the rest — in either picker, or on the Institutions list screen, where the surplus was not even editable. Both now fetch unbounded.

Subscription options listed parent products only, so a gate holding a variation ID had no matching option to render or re-select. Woo Memberships–migrated data carries those IDs, and the rule already honours them. Variations are now listed alongside their parent, so a gate can require one tier without requiring the others.

Institution options stay published-only: an unpublished institution is never evaluated, so offering one would build a rule that silently does nothing.

Closes NPPD-2135.

Stacked on #756 — targets its branch, not main. #756 rewrites the same picker lines.

How to test the changes in this Pull Request:

1. Check out this branch. Enable NEWSPACK_CONTENT_GATES. Activate WooCommerce and WooCommerce Subscriptions.
2. Create 120 institutions under Audience > Access Control > Institutions.
3. Open the Institutions list. Confirm the table lists all 120.
4. Create a subscription product. Create a variable subscription product with two variations.
5. Open Audience > Access Control and edit a gate. Enable Paid Access.
6. Enable the Institutional access rule. Click its field.
7. Confirm the list shows all 120 institutions. Before this change it stopped at 100.
8. Enable the Active subscription rule. Click its field.
9. Confirm both variations are listed, each as <name> (#<id>). Before this change only the parents appeared.
10. Select one variation. Save the gate. Reload the page.
11. Confirm the variation is still selected and shows its name.
12. Edit a post. Add a Group block. Open Access Control in the block sidebar.
13. Enable the Institutional access rule. Confirm the list shows all 120 institutions.

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully run tests with your changes locally?

Verified on an isolated env with 120 institutions and a variable subscription; OK (2366 tests, 6698 assertions), PHPCS clean.

Follow-up filed while working on this: NPPD-2143 — the institutional rule fails open when a site has no institutions, because the picker degrades to free text and a string value grants access to everyone. Pre-existing; not addressed here.