Account for enforced policies in policy approval setting overrides

What does this MR do and why?

We are working on warn mode for merge request approval policies (&15552).

Addresses a follow-up to !208075 (merged) where we started noting approval_settings overrides from merge request approval policies that are in warn-mode.

When a warn-mode and default-enforced policy apply to a project, and the warn-mode policy's approval_settings override the project settings, this should only be considered an override if the default-enforced policy's approval_settings doesn't enforce the setting.

References

• #563868 (comment 2811227343)
• &19036

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. Enable the feature flag: echo "Feature.enable(:security_policy_approval_warn_mode)" | rails c
2. Create a new project
3. Navigate to Settings > Merge requests, and under Approval settings, untick the Prevent approval by merge request creator checkbox and click Save changes
4. Navigate to Code > Branches and create the foobar branch
5. Navigate to Settings > Protected branches and protect the foobar branch
6. Navigate to Secure > Policies and create the following Merge request approval policies:

approval_policy:
  - name: Warn Mode Policy A
    enabled: true
    enforcement_type: warn
    rules:
      - type: any_merge_request
        branch_type: protected
        commits: any
    actions:
      - type: require_approval
        approvals_required: 1
        role_approvers:
          - owner
      - type: send_bot_message
        enabled: true
    approval_settings:
      prevent_approval_by_author: true
      require_password_to_approve: false

approval_policy:
  - name: Warn Mode Policy B
    enabled: true
    enforcement_type: warn
    rules:
      - type: any_merge_request
        branch_type: protected
        commits: any
    actions:
      - type: require_approval
        approvals_required: 1
        role_approvers:
          - owner
      - type: send_bot_message
        enabled: true
    approval_settings:
      prevent_approval_by_author: false
      require_password_to_approve: true

approval_policy:
  - name: Enforced Policy
    enabled: true
    rules:
      - type: any_merge_request
        branch_type: protected
        commits: any
    actions:
      - type: require_approval
        approvals_required: 1
        role_approvers:
          - owner
      - type: send_bot_message
        enabled: true
    approval_settings:
      prevent_approval_by_author: true

4. Open a new merge request targeting the default branch
5. Compare the approval setting override section in the bot comment to the screenshot above

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #563868 (closed)