Add routing logic for Duo Code Review between classic and DAP

What does this MR do and why?

This MR consolidates and refactors the Duo Code Review routing logic between the classic AI Gateway flow and the modern Duo Agent Platform (DAP) workflow. It introduces a centralized validator to determine which implementation should be used based on feature flags, add-on types, platform configuration, and beta/experiment feature settings.

Routing Decision Table

Add-on	Feature Flag	Internal User	Experimental/Beta Features	Flow Used
Duo Enterprise	ON	Yes	N/A	DAP
Duo Enterprise	ON	No	N/A	Classic
Duo Enterprise	OFF	N/A	N/A	Classic
Duo Pro/Core	ON	N/A	Yes	DAP
Duo Pro/Core	ON	N/A	No	❌ None
Duo Pro/Core	OFF	N/A	N/A	❌ None

Notes:

• Duo Pro/Core customers need experimental features (SaaS) or instance beta features (self-managed) enabled to access DAP-based code review until GA in 18.7. Without this, the auto_duo_code_review_enabled setting won't be available.
• Duo Pro/Core never had classic Duo Code Review - DAP is their only path to this feature
• For Duo Enterprise: DAP flow only available to internal GitLab users during gradual rollout, classic flow remains available to all
• Self-hosted instances require compatible AI model (not Llama3) and DWS URL configured for DAP flow
• SaaS customers always have DWS available

Validation checklist

Duo Enterprise customers

Should use Classic Flow:

• Feature flag duo_code_review_on_agent_platform is disabled
• Feature flag enabled but user is external (duo_code_review_dap_internal_users is disabled)

Should use DAP Flow:

• Feature flag enabled + internal GitLab user (duo_code_review_dap_internal_users is enabled)

Settings should be available:

• Application level: Active Duo Enterprise purchase (always, regardless of feature flags)
• Namespace level: Root namespace with active Duo Enterprise purchase (always, regardless of feature flags)
• Project level: Project with duo_features_enabled + namespace has active Duo Enterprise purchase

Settings should NOT be available:

• duo_features_enabled is false at project/namespace/application level

Duo Pro/Core customers

Should use DAP Flow:

• Feature flag enabled + beta/experiment features enabled (additionally, DWS configured + compatible AI model for self-hosted)

Should be Blocked (no code review available):

• Feature flag duo_code_review_on_agent_platform is disabled
• Beta/experiment features disabled

Settings should be available:

• Application level: Active Duo Pro/Core purchase + DAP feature flag enabled
• Namespace level: Root namespace with active Duo Pro/Core purchase + DAP feature flag enabled + experiment features enabled
• Project level: Project with duo_features_enabled + namespace meets above criteria

Settings should NOT be available:

• duo_features_enabled is false at project/namespace/application level
• Feature flag duo_code_review_on_agent_platform is disabled
• Beta/experiment features disabled

No add-on purchase

Should be Blocked (no code review available):

• No active Duo add-on purchase

Settings should NOT be available:

• No active Duo add-on purchase
• duo_features_enabled is false at project/namespace/instance level

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/579921