New projects inherit parent value for duo_features_enabled

What does this MR do and why?

• This is not a problem for new groups because the default value is nil so the cascading settings framework does the inheritance correclty.
• Projects, on the other hand, have a default value of true
• This fix is specifically for when the parent has the value set to "default off". When "always off" is set on the parent, that is correctly inherited by all children.
• Minor fix: this also addresses Duo cascading to existing child objects if Duo is set to "off" when Amazon Q is first enabled

Database review

SQL query for project.project_setting.update!(duo_features_enabled: false) using the project id from the AI Gateway project (this will be run on newly-created projects only so a smaller project seemed more fitting):

"UPDATE "project_settings" SET "updated_at" = '2025-07-24 23:39:52.164830', "duo_features_enabled" = FALSE WHERE "project_settings"."project_id" = 39903947

https://explain.depesz.com/s/yZeA

References

#556298 (closed)

How to set up and validate locally

In SM mode:

1. Set the instance to have Duo Features "default off"
2. Create a new project
3. New project should have Duo disabled

In SaaS Mode:

1. Set a top-level group to have Duo Features "default off"
2. Create a new project within the group
3. New project should have Duo disabled

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.