[Ban AI] Add REST and GraphQL mutations/resources to update/read `duo_features_enabled`

Context

• Blocked by [Ban AI] Add backend for cascading setting `duo... (#441481 - closed)
• Should be merged after [Ban AI] Block all AI features for a resource w... (#441486 - closed) so that we don't provide a documented way of updating these settings before they are actually enforced.
• This was already done for the duo_features_enabled setting at the project level via !143972 (merged)
• This is an EE-only feature available to Ultimate-plan customers

Definition of done

• GraphQL mutations are available to update the values of duo_features_enabled and lock_duo_features_enabled for a group (namespace_settings)
• API endpoints can be used to update the values of duo_features_enabled and lock_duo_features_enabled for a group (namespace_settings) or entire GitLab instance (application_settings)
• Only an instance or group admin can update this setting
• Also should be able to read these values a via GraphQL query, perhaps on an existing _type, which is what we did for projects (added to Types::ProjectType)
• GitLab Duo documentation should link to this GraphQL documentation so that customers know how to update these attributes via the API.