Fix the conditions when we scope to gitlab-org

Locate the root namespace with path `gitlab-org` and then select all the
image repositories (including those in subgroups)

EE: true
Changelog: fixed

ee/app/models/ee/container_repository.rb

@@ -29,7 +29,12 @@ module EE
         return all if ::ContainerRegistry::Migration.all_plans?
 
         if ::ContainerRegistry::Migration.limit_gitlab_org?
-          joins(project: [:namespace]).where(namespaces: { path: GITLAB_ORG_NAMESPACE })
+          gitlab_org_namespace = ::Namespace.top_most.by_path(GITLAB_ORG_NAMESPACE)
+          return none unless gitlab_org_namespace
+
+          project_scope = ::Project.for_group_and_its_subgroups(gitlab_org_namespace)
+                            .select(:id)
+          where(project_id: project_scope)
         else
           where(migration_plan: ::ContainerRegistry::Migration.target_plans)
         end

ee/spec/models/container_repository_spec.rb

@@ -25,6 +25,23 @@ RSpec.describe ContainerRepository, :saas do
 
       context 'limit_gitlab_org enabled' do
         it { is_expected.to contain_exactly(gitlab_container_repository) }
+
+        context 'with sub group named gitlab-org' do
+          let_it_be(:root) { create(:group, path: 'test-root') }
+          let_it_be(:subgroup) { create(:group, path: 'gitlab-org', parent: root) }
+          let_it_be(:subproject) { create(:project, namespace: subgroup) }
+          let_it_be(:subgroup_repository) { create(:container_repository, project: subproject) }
+
+          it { is_expected.to contain_exactly(gitlab_container_repository) }
+        end
+
+        context 'with no gitlab root namespace' do
+          before do
+            expect(::Namespace).to receive(:by_path).with('gitlab-org').and_return(nil)
+          end
+
+          it { is_expected.to be_empty }
+        end
       end
 
       context 'limit_gitlab_org disabled' do