[Ban AI] Settings to disable Duo can be updated from the GitLab UI

Context

• Blocked by [Ban AI] Block all AI features for a resource w... (#441486 - closed) (we don't want to show these settings or make them updateable until they are actually enforced)
• This issue is a stretch goal for %16.10 , it is OK if we don't get to it until %16.11
• We are using the cascading settings framework, which includes some view helpers for this.
• This is an EE-only feature available to Ultimate-plan customers

Definition of done

• User can update duo_features_enabled via the application, group, and project settings.
• User can update lock_duo_features_enabled at the application and group settings levels.
• This setting should be visible for Ultimate customers only.