Add Lock/Unlock feature to specific approval rules in group-level MR approval rules settings

Problem to solve

In pursuit of the holistic solution outlined in &4367, this issue is a smaller implementation issue to iteratively move elements of project-level merge request approval rules to the group-level.

Please see &4367 for the discovery and implementation discussion.

Intended users

• Cameron (Compliance Manager)
• Sidney (Systems Administrator)

User experience goal

A group owner can configure this setting - Lock/Unlock - at the group level for individual MR approval rules.

Proposal

This should be behind a feature flag.

Add the Lock/Unlock option to the individual MR approval rules at the group level.

• Locked: The approval rule is uneditable at the project level
• Unlocked: The approval rule is editable at the project level

Further details

We should build this behind a feature flag so we can complete the entire implementation before enabling that flag by default. This should help us ensure there's a solid UX that accounts for the different preferences our users have around inheritance and enforcement.