Add RuboCop cop to prevent EE feature flags in FOSS code

What does this MR do and why?

This MR implements the idea suggested in !215324 (comment 2934502891).

It adds a new RuboCop cop Gitlab/EeFeatureFlagInFoss that detects when feature flags defined in ee/config/feature_flags/ are being used in FOSS code (outside the ee/ directory).

This prevents issues like the one in !215324 (merged) where an EE feature flag (agentic_chat_ga) was referenced in lib/gitlab/gon_helper.rb, causing FOSS-only tests to fail.

How does it work?

The cop:

• Reuses logic from MarkUsedFeatureFlags to detect feature flag usage
• Loads feature flags from both config/feature_flags/ and ee/config/feature_flags/
• Checks if a flag is defined only in EE (not in FOSS)
• Reports an offense if an EE-only flag is used outside the ee/ directory
• Suggests moving the code to the ee/ directory or moving the feature flag definition to config/feature_flags/

Supported feature flag methods

The cop detects usage in:

• Feature.enabled?(:flag)
• Feature.disabled?(:flag)
• push_frontend_feature_flag(:flag, user)
• push_force_frontend_feature_flag(:flag, user)
• FEATURE_FLAG = :flag
• self.limit_feature_flag = :flag
• And more (see the cop for full list)

Example

# bad (in lib/gitlab/gon_helper.rb with ee/config/feature_flags/beta/agentic_chat_ga.yml)
push_frontend_feature_flag(:agentic_chat_ga, current_user)

# good (in ee/lib/ee/gitlab/gon_helper.rb)
push_frontend_feature_flag(:agentic_chat_ga, current_user)

# good (in lib/gitlab/gon_helper.rb with config/feature_flags/beta/some_flag.yml)
push_frontend_feature_flag(:some_flag, current_user)

Related

Implements !215324 (comment 2934502891)