Add controllers and frontend for DPoP

What does this MR do and why?

This MR adds the controller and frontend code for Add DPoP checks in GraphQL and API requests (!169013 - merged).

Related to Sender constraining personal access tokens (#425130).

References

See the epic (Allow users to require demonstrated proof of po... (&14383)) for context, pre-work, and other related issues.

Screenshots or screen recordings

When dpop_authentication FF is disabled:

When :dpop_authentication FF is enabled:

How to set up and validate locally

1. Checkout this branch locally.
2. Run bin/rails db:migrate
3. In rails console, enable the feature flag: Feature.enable(:dpop_authentication, User.first)
4. Login as root.
5. Go to Settings > Access tokens > Toggle the DPoP option.
6. Confirm it persists in the database User.first.dpop_enabled and also on the frontend after refreshing the page.

app/controllers/user_settings/personal_access_tokens_controller.rb

@@ -91,6 +91,23 @@ def rotate
       end
     end
 
+    def toggle_dpop
+      unless Feature.enabled?(:dpop_authentication, current_user)
+        redirect_to user_settings_personal_access_tokens_path
+        return
+      end
+
+      result = UserPreferences::UpdateService.new(current_user, dpop_params).execute
+
+      if result.success?
+        flash[:notice] = _('DPoP preference updated.')
+      else
+        flash[:warning] = _('Unable to update DPoP preference.')
+      end
+
+      redirect_to user_settings_personal_access_tokens_path
+    end
+
     private
 
     def finder(options = {})
@@ -101,6 +118,10 @@ def personal_access_token_params
       params.require(:personal_access_token).permit(:name, :expires_at, :description, scopes: [])
     end
 
+    def dpop_params
+      params.require(:user).permit(:dpop_enabled)
+    end
+
     def set_index_vars
       @scopes = Gitlab::Auth.available_scopes_for(current_user)