Add DPoP checks in GraphQL and API requests

What does this MR do and why?

See Sender constraining personal access tokens (#425130 - closed) for more context. This MR makes use of the backend DPoP checks that are introduced in Parse and validate DPoP Tokens (!166206 - merged).

How to set up and validate locally

1. In rails console, enable the feature flag for the user you are going to be testing the feature with:

Feature.enable(:dpop_authentication, User.find(1))

2. Using the rails console, enable DPoP for the user :

UserPreferences::UpdateService.new(User.find(1), {dpop_enabled: true}).execute

3. Ensure you have an SSH key-pair setup with the public key uploaded to your user account. Ensure that the key type is saved as "Signing" or "Authentication and Signing".
4. Build glab from this branch.
5. Using glab generate a DPoP header: bin/glab auth dpop-gen --pat "<glpat-PAT>" --private-key ~/.ssh/id_rsa
6. Use the generated header to make an HTTP API request eg.: curl http://localhost:3000/api/v4/projects --header "Private-Token: <glpat-PAT>" --header "DPoP: <GLAB OUTPUT HERE>"
7. Confirm valid response is received. Confirm that the request fails without a valid DPoP header.
8. Repeat and confirm for GraphQL requests, e.g. curl -X POST -H "Content-Type: application/json" -H "Private-Token: <glpat-PAT>" -H "DPoP: <GLAB OUTPUT HERE>" -d '{ "query": "query { currentUser { id } }" }' "http://localhost:3000/api/graphql"
9. Confirm that the server responds with accurate error messages related to the failing DPoP check (eg. signature expired, JWT invalid, etc.).

assigned to @ameyadarshan

added pipelinetier-3 pipeline:run-e2e-omnibus-once labels

added backend label

Proper labels assigned to this merge request. Please ignore me.

👋 @ameyadarshan - please see the following guidance and update this merge request.

	1 Error
❌	Please add typebug typefeature, or typemaintenance label to this merge request.

mentioned in merge request !166206 (merged)

added 4 commits

• 3aa42034...c0ebefd8 - 3 commits from branch ameya-dpop-1
• bc1a38d6 - Merge branch 'ameya-dpop-1' into 'ameya-dpop-2'

Compare with previous version

E2E Test Result Summary

allure-report-publisher generated test report!

e2e-test-on-gdk: ➖ test report for f2f98757

expand test summary

+------------------------------------------------------------+
|                       suites summary                       |
+-------+--------+--------+---------+-------+-------+--------+
|       | passed | failed | skipped | flaky | total | result |
+-------+--------+--------+---------+-------+-------+--------+
+-------+--------+--------+---------+-------+-------+--------+
| Total | 0      | 0      | 0       | 0     | 0     | ➖     |
+-------+--------+--------+---------+-------+-------+--------+

added 1 commit

• 342e6e81 - Add REST API check and fix GraphQL check

Compare with previous version

added 1 commit

• f2f98757 - Delete test file

Compare with previous version

added AppSecWorkTypeKR label

added AppSecWeightXLarge label

added AppSecWorkflowin-progress label

changed milestone to %17.6

added Application Security Team label

added typefeature label and removed Application Security Team label

resolved all threads

mentioned in issue #425130 (closed)

added devopsgovern groupauthentication sectionsec labels

changed the description