Add Security Policy Default source

This MR adds a new config source to allow scan
execution policies to create pipelines to
enforce security scans even if the Auto DevOps
is disabled and no .gitlab-ci.yml is available.

Changelog: added
MR: !121087

ee/lib/ee/gitlab/ci/project_config.rb

@@ -10,6 +10,7 @@ module ProjectConfig
 
         override :sources
         def sources
+          # SecurityPolicyDefault should come last. It is only necessary if no other source is available.
           [::Gitlab::Ci::ProjectConfig::Compliance].concat(super)
                                                    .concat([::Gitlab::Ci::ProjectConfig::SecurityPolicyDefault])
         end