Order workflows alphabetically in credential revoke dialog

[elias-ba]

Description

Small cleanup, not a user-visible fix.

The query behind the credential revoke-access dialog ("this credential is in use by the following workflows: ...") selects distinct workflow names with no explicit ordering, so the order was left to the database. In practice it already comes out alphabetical as a side effect of how the distinct is executed, but that is an implementation detail, not a guarantee. This adds an explicit order-by so the alphabetical order is guaranteed rather than incidental.

It also adds unit tests for project_workflows_using_credentials/1, which previously had none, covering how it groups results by project, filters by credential, and returns the names sorted.

Note: a test cannot meaningfully prove the order-by is doing anything, because the database sorts on its own at test-scale data. The added tests assert the function's contract (grouping, filtering, sorted result); they are not a regression guard for the ordering specifically.

Closes #4954

Validation steps

1. Create a credential and share it with a project that has two or more workflows using it.
2. Open the credential and start to revoke its access to that project.
3. Confirm the dialog lists the affected workflows in alphabetical order.

Additional notes for the reviewer

AI Usage

Please disclose whether you've used AI anywhere in this PR (it's cool, we just
want to know!):

• I have used Claude Code
• I have used another model
• I have not used AI

You can read more details in our
Responsible AI Policy

Pre-submission checklist

• I have performed an AI review of my code (we recommend using /review with Claude Code)
• I have implemented and tested all related authorization policies. (e.g., :owner, :admin, :editor, :viewer)
• I have updated the changelog.
• I have ticked a box in "AI usage" in this PR

[github-actions]

Security Review ✅

• S0 (project scoping): N/A — change only adds order_by: w.name to an existing read query in lib/lightning/workflows.ex:78; filtering behavior (project_credential_id in ^ids) is unchanged.
• S1 (authorization): N/A — no new web-layer actions, controllers, or LiveView events; only a query-shape tweak.
• S2 (audit trail): N/A — no writes to project/instance configuration; read-only query and test/changelog updates.