Move Code Suggestions Duo availability check into a policy

The check that blocks Code Suggestions when GitLab Duo is off lives in Ai::UserAuthorizable#code_suggestions_blocked_for? and is called from the API in duo_disabled_for_request?. Duo Chat does this kind of check in a policy instead. We should do the same for Code Suggestions.

Follow-up from !251569 (comment 3724072617)

What to do

• Move the logic into a subject-scoped :access_code_suggestions policy, like Duo Chat.
• Keep the current behavior:
  • Use the project when the request has a project_path.
  • Fall back to the user's governing namespace when there is no project, or when the user cannot read the project.
  • Do not block when no namespace can be found.
• Update the API to use the policy, and remove duo_disabled_for_request? and code_suggestions_blocked_for? if they are no longer needed.
• Keep the tests green for all the cases above.

Out of scope

• Any change to how GitLab Duo availability itself works.