Default-enable the labkit rack cohort flags for self-managed

Problem

The six wip flags rate_limiter_use_labkit_rack_cohort_{1,2,3} / ..._enforce default off, so self-managed still runs Rack::Attack as the enforcer with labkit dormant. GitLab.com has been labkit-only since 2026-08-12. We cannot remove Rack::Attack while self-managed depends on it.

Solution

Flip all six defaults to enabled per the feature-flag lifecycle. Once every cohort enforces, the labkit_fully_enforced safelist automatically turns Rack::Attack into a pass-through; no separate switch is needed. Soak for at least one milestone before flag removal.

Notes:

• The flag names are constructed by interpolation in lib/gitlab/rack_attack/labkit_rate_limit/throttle_registry.rb:161-181, so plain greps and feature-flag tooling miss them.
• One user-visible semantic change needs a release note for self-managed admins: labkit uses TTL-based fixed windows instead of Rack::Attack's clock-aligned windows, so clients bursting right at the limit boundary are blocked somewhat more strictly. Aggregate parity was verified on GitLab.com before cutover.