feat(df): add policy engine

Adds the policy package: checker types, runtime selector, env-driven fake checker (GLAB_DF_FAKE_*), GraphQL stub, caching wrapper, and fail-closed behavior.

Note: The API has not merged, so this MR has a placeholder for the API call and some environment variables to simulate responses.

There is an integration branch feat/dependency-firewall that has all of the changes.

Stacked on !3721 (merged) (target branch: df-mr-02-purl).