Add new jsonb column to store settings for default branch protection

What does this MR do and why?

Currently, the options for default branch protection at the instance and group level lag behind, and are not as fine-grained, as the options available from the Protected Branches feature

The branch defaults lag behind because the current implementation uses an integer column to store the default settings, which becomes difficult to expand as new options and finer detail controls are added to the protected branches feature

at a high-ish level the existing feature is implemented as:

1. there are integer columns on the database tables (application level and group level)
2. these integers are mapped to a subset of protected branch settings
   • these mappings defined in access.rb
   • mappings are used here via BranchProtection helper
3. when creating a default branch, those settings are passed into the protected branch service

To offer better support of protected branches features on the default branch, we can:

1. use a jsonb column rather than an integer
2. update the settings API to accept a payload the matches the protected branches API
3. Pass those settings into the ProtecteBrancheService

This commit performs step 1, by adding a new jsonb column

resolves: #408150 (closed) Changelog: added

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

app/models/application_setting.rb

@@ -31,6 +31,9 @@ class ApplicationSetting < MainClusterwide::ApplicationRecord
     archive_builds_in_seconds: 'Archive job value'
   }.freeze
 
+  # matches the size set in the database constraint
+  DEFAULT_BRANCH_PROTECTIONS_DEFAULT_MAX_SIZE = 1.kilobyte
+
   enum whats_new_variant: { all_tiers: 0, current_tier: 1, disabled: 2 }, _prefix: true
   enum email_confirmation_setting: { off: 0, soft: 1, hard: 2 }, _prefix: true
 
@@ -86,6 +89,7 @@ def self.kroki_formats_attributes
   attribute :id, default: 1
   attribute :repository_storages_weighted, default: -> { {} }
   attribute :kroki_formats, default: -> { {} }
+  attribute :default_branch_protection_defaults, default: -> { {} }
 
   chronic_duration_attr_writer :archive_builds_in_human_readable, :archive_builds_in_seconds
 
@@ -93,6 +97,9 @@ def self.kroki_formats_attributes
   chronic_duration_attr :group_runner_token_expiration_interval_human_readable, :group_runner_token_expiration_interval
   chronic_duration_attr :project_runner_token_expiration_interval_human_readable, :project_runner_token_expiration_interval
 
+  validates :default_branch_protection_defaults, json_schema: { filename: 'default_branch_protection_defaults' }
+  validates :default_branch_protection_defaults, bytesize: { maximum: -> { DEFAULT_BRANCH_PROTECTIONS_DEFAULT_MAX_SIZE } }
+
   validates :grafana_url,
     system_hook_url: ADDRESSABLE_URL_VALIDATION_OPTIONS.merge({
       blocked_message: "is blocked: %{exception_message}. #{GRAFANA_URL_ERROR_MESSAGE}"