[Ban AI] Audit event for when duo_features_enabled is set for a project or group

Similar to the audit event we added here for the root group-level code_suggestions setting, we should emit an audit event whenever the value of duo_features_enabled is changed for a group or project.

This will allow admins to audit who and when changed this setting.

This is blocked by !144931 (merged), which adds the duo_features_enabled setting to the namespace_settings table

Note: the event is currently emitted from NamespaceSetting::UpdateService. But that service does not actually persist the change to the namespace settings, it just sets the attributes. So there is a chance that the group update (which calls NamespaceSetting::UpdateService) is invalid and therefore fails. As a result, we could see events published for changes that are not persisted. I suggest that we move the publish_event action from NamespaceSettings::UpdateService into the after_update method in Groups::UpdateService so that we only emit this event when the change is successful.

^ will be handled separately: Move call to `AiRelatedSettingsChangedEvent` (#444224 - closed)