Add controllers and frontend for DPoP

What does this MR do and why?

This MR adds the controller and frontend code for Add DPoP checks in GraphQL and API requests (!169013 - merged).

Related to Sender constraining personal access tokens (#425130).

References

See the epic (Allow users to require demonstrated proof of po... (&14383)) for context, pre-work, and other related issues.

Screenshots or screen recordings

When dpop_authentication FF is disabled:

When :dpop_authentication FF is enabled:

How to set up and validate locally

1. Checkout this branch locally.
2. Run bin/rails db:migrate
3. In rails console, enable the feature flag: Feature.enable(:dpop_authentication, User.first)
4. Login as root.
5. Go to Settings > Access tokens > Toggle the DPoP option.
6. Confirm it persists in the database User.first.dpop_enabled and also on the frontend after refreshing the page.

app/views/user_settings/personal_access_tokens/_dpop.html.haml

@@ -2,12 +2,12 @@
   .settings-section.js-search-settings-section
     .settings-sticky-header
       .settings-sticky-header-inner
-        %h3.gl-my-0
+        %h3.gl-heading-4.gl-mb-3
           = s_('AccessTokens|Require DPoP (Demonstrating Proof of Possession) headers')
-    %p.gl-text-secondary
-      = s_('AccessTokens|Require DPoP headers to access the REST or GraphQL API with a personal access token.')
-      = succeed '.' do
-        = link_to _('How do I use DPoP headers?'), help_page_path('user/profile/personal_access_tokens.md', anchor: 'require-dpop-headers-with-personal-access-tokens'), target: '_blank', rel: 'noopener noreferrer'
+        %p.gl-text-secondary
+          = s_('AccessTokens|Require DPoP headers to access the REST or GraphQL API with a personal access token.')
+          = succeed '.' do
+            = link_to _('How do I use DPoP headers?'), help_page_path('user/profile/personal_access_tokens.md', anchor: 'require-dpop-headers-with-personal-access-tokens'), target: '_blank', rel: 'noopener noreferrer'
     .form-group
       = f.gitlab_ui_checkbox_component :dpop_enabled, s_('AccessTokens|Enable DPoP'), checkbox_options: { checked: @user.dpop_enabled }
     = f.submit _('Save changes'), pajamas_button: true