Add Demonstrating Proof of Possession (DPoP) for Personal Access Tokens

What does this MR do and why?

This MR initiates the implementation of sender-constrained access tokens designed to minimise the risk of token leaks. I am putting this feature behind a feature flag.

Related to Sender constraining personal access tokens (#425130).

How to set up and validate locally

Currently this feature works only for RSA keys. Support for other algorithms will be added later.

For frontend:

1. Checkout this branch locally.
2. Run bin/rails db:migrate
3. In rails console, enable the feature flag: Feature.enable(:dpop_authentication, User.first)
4. Login as root.
5. Go to Settings > Access tokens > Toggle the DPoP option.
6. Confirm it persists in the database User.first.dpop_enabled and also on the frontend on refreshing the page.

For backend:

1. Build glab from this branch.
2. Ensure DPoP is enabled following the steps above.
3. Ensure you have an SSH key-pair setup with the public key uploaded to your user account. Ensure that the key type is saved as "Signing" or "Authentication and Signing".
4. Using glab generate a DPoP header: bin/glab auth dpop-gen --pat "glpat-PAT" --private-key ~.ssh/id_rsa
5. Use the generated header to make an HTTP API request: curl http://localhost:3000/api/v4/projects --header "Private-Token: glpat-PAT" --header "DPoP: <GLAB OUTPUT HERE>"
6. Confirm valid response is received. Confirm that the request fails without a valid DPoP header.

app/controllers/user_settings/personal_access_tokens_controller.rb

@@ -9,6 +9,7 @@ class PersonalAccessTokensController < ApplicationController
 
     before_action :check_personal_access_tokens_enabled
     prepend_before_action(only: [:index]) { authenticate_sessionless_user!(:ics) }
+    before_action :user
 
     def index
       set_index_vars
@@ -60,8 +61,29 @@ def revoke
       redirect_to user_settings_personal_access_tokens_path
     end
 
+    def toggle_dpop
+      unless Feature.enabled?(:dpop_authentication, user, type: :beta)
+        redirect_to user_settings_personal_access_tokens_path
+        return
+      end
+
+      result = UserPreferences::UpdateService.new(@user, dpop_params).execute
+
+      if result.success?
+        flash[:notice] = _('DPoP preference updated.')
+      else
+        flash[:warning] = _('Unable to update DPoP preference.')
+      end
+
+      redirect_to user_settings_personal_access_tokens_path
+    end
+
     private
 
+    def dpop_params
+      params.require(:user).permit(:dpop_enabled)
+    end
+
     def finder(options = {})
       PersonalAccessTokensFinder.new({ user: current_user, impersonation: false }.merge(options))
     end
@@ -70,6 +92,10 @@ def personal_access_token_params
       params.require(:personal_access_token).permit(:name, :expires_at, scopes: [])
     end
 
+    def user
+      @user = current_user
+    end
+
     def set_index_vars
       @scopes = Gitlab::Auth.available_scopes_for(current_user)
       @active_access_tokens = active_access_tokens