Lists the organizations granted a capability, one cursor page at a time.

The named platform-wide capability entitlements a customer can be granted. Each maps to a capability object in the authorization graph; convert to its object id with string CapabilityExtensions.ToObjectId(Capability capability). Kept as a typed enum so capability grants read explicitly at call sites (and, later, on endpoint contracts) instead of passing raw id strings around.