Add controllers and frontend for DPoP

What does this MR do and why?

This MR adds the controller and frontend code for Add DPoP checks in GraphQL and API requests (!169013 - merged).

Related to Sender constraining personal access tokens (#425130).

References

See the epic (Allow users to require demonstrated proof of po... (&14383)) for context, pre-work, and other related issues.

Screenshots or screen recordings

When dpop_authentication FF is disabled:

When :dpop_authentication FF is enabled:

How to set up and validate locally

1. Checkout this branch locally.
2. Run bin/rails db:migrate
3. In rails console, enable the feature flag: Feature.enable(:dpop_authentication, User.first)
4. Login as root.
5. Go to Settings > Access tokens > Toggle the DPoP option.
6. Confirm it persists in the database User.first.dpop_enabled and also on the frontend after refreshing the page.

app/controllers/user_settings/personal_access_tokens_controller.rb

@@ -11,7 +11,6 @@ class PersonalAccessTokensController < ApplicationController
     before_action do
       push_frontend_feature_flag(:pat_ip, current_user)
     end
-    before_action :user
     prepend_before_action(only: [:index]) { authenticate_sessionless_user!(:ics) }
 
     def index
@@ -82,12 +81,12 @@ def rotate
     end
 
     def toggle_dpop
-      unless Feature.enabled?(:dpop_authentication, @user)
+      unless Feature.enabled?(:dpop_authentication, current_user)
         redirect_to user_settings_personal_access_tokens_path
         return
       end
 
-      result = UserPreferences::UpdateService.new(@user, dpop_params).execute
+      result = UserPreferences::UpdateService.new(current_user, dpop_params).execute
 
       if result.success?
         flash[:notice] = _('DPoP preference updated.')
@@ -112,10 +111,6 @@ def dpop_params
       params.require(:user).permit(:dpop_enabled)
     end
 
-    def user
-      @user = current_user
-    end
-
     def set_index_vars
       @scopes = Gitlab::Auth.available_scopes_for(current_user)
       @active_access_tokens, @active_access_tokens_size = active_access_tokens