fix(frontend): report every alias of a blocked component to the editor (#14719)

/config reports the blocked component identities so the editor can name a
cause, but it reported only the administrator's key and the canonical
identities that key resolves to. Alias resolution runs alias -> canonical
only, so blocking the canonical key left every node saved under an alias
unmatched: with `Prompt Template` blocked, a node saved as `Prompt` was
not named on any of the three surfaces.

The palette exposes only the canonical key, so that is the key an
administrator can find, and nine shipped starter flows -- including the
featured Basic Prompting -- save that component as `Prompt`. `parser` and
`AstraDB` are the same shape. The user edited such a flow, saw no banner,
the build preflight passed, autosave never paused, and the write was
discarded with a 400 the user never saw.

_resolve_catalog_policy_matches decides the write by resolving the node
side too and intersecting, so the reverse of that rule is applied here:
every alias whose canonical candidates meet the blocked identities is
reported, including an alias ambiguous across components, which the
server also blocks. The editor's answer now matches the one that decides
whether the save succeeds.

Reported by QA while verifying #14681, which narrowed #14614's
"any policy exists" over-claim and removed the coverage that over-claim
incidentally gave this case.