Sync security policies after group transfer

What does this MR do and why?

When you move a group, we currently don't synchronize the security policies that apply to the group's contained projects, which this merge request fixes.

References

• #545805 (closed)

How to set up and validate locally

Enable the feature flag:

echo "Feature.enable(:security_policies_group_transfer_sync)" | rails c

Set up a group hierarchy such as:

top
├── middle
│   ├── bottom
│   │   ├── bottom-security-policy-project
│   │   └── test-project
│   │       └── test-project-security-policy-project
│   └── bottom-security-policy-project
└── top-security-policy-project

For every group and the test project, define a test policy with distinct names:

approval_policy:
  - name: Test Policy $N
    enabled: true
    rules:
      - type: any_merge_request
        branch_type: protected
        commits: any
    actions:
      - type: require_approval
        approvals_required: 1
        role_approvers: [owner]
      - type: send_bot_message
        enabled: true

Open a merge request targeting test-project. Move any of the groups around via Settings > General > Advanced: within the hierarchy, to the top-level, or into another group hierarchy, and verify that the merge request requires approval only for policies within its hierarchy.

Database queries

-- https://console.postgres.ai/gitlab/gitlab-production-main/sessions/41805/commands/128279
SELECT
	"security_policies"."security_orchestration_policy_configuration_id"
FROM
	"security_policies"
	INNER JOIN "security_policy_project_links" ON "security_policies"."id" = "security_policy_project_links"."security_policy_id"
	INNER JOIN "security_orchestration_policy_configurations" ON "security_orchestration_policy_configurations"."id" = "security_policies"."security_orchestration_policy_configuration_id"
WHERE
	"security_policy_project_links"."project_id" = 278964
	AND "security_orchestration_policy_configurations"."project_id" IS NULL;

Because of the maximum subgroup depth of 20 (docs), and because each group can have 0..1 policy configurations assigned, and each configuration can store up to 20 policies (docs), this query will never join more than 400 rows from security_policies.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #545805 (closed)