feat(df): add policy checker interface, types, and fake

First of three MRs splitting the former policy MR (!3722 (closed)) into reviewable pieces.

Introduces the policy package seam between the inspection proxy and the verdict source:

• Checker interface and the Request/Result/Coordinate types.
• An environment-driven fake checker (GLAB_DF_FAKE_*) for tests and local runs.
• New() selects the fake when any GLAB_DF_FAKE_* var is set; the non-fake path returns a fail-closed placeholder (ErrNotImplemented) until the REST checker lands. The *gitlab.Client/projectID params are already threaded so the follow-up needs no signature change.

Note that the completed code is available on feat/dependency-firewall. This MR and the other stacked MRs are created from this integration branch. Not all of the MRs have been created yet.

Follow-ups (stacked):

• 3b: caching decorator (CachingChecker).
• 3c: REST evaluate checker, wiring New()'s non-fake path to the real API.