Set a model's sharing config

Sharing controls where a workspace-owned entity is visible and what consuming projects may do with it. Entities adopt it as one branch of a oneof scope { string project_id; Sharing sharing; } union: project-owned entities carry project_id, workspace-owned entities carry sharing. Reads for project-scoped callers include entities shared with their projects; mutation of workspace-owned entities is reserved for management keys / workspace admins.