Add a top-level group setting to control prompt scanning

What does this MR do and why?

Add a top-level group setting to control prompt scanning.

Related issue: https://gitlab.com/gitlab-org/gitlab/-/issues/584247+

Feature flag issue: [FF] `ai_prompt_scanning` -- Control ai_prompt_... (#584290)

Implementation Details

Database Changes

• Migration: Added prompt_injection_protection_level column to namespace_ai_settings table

Backend Implementation

• Model (Ai::NamespaceSetting):

  • Added enum for prompt_injection_protection_level with three values

• API (GroupsHelpers):

  • Added prompt_injection_protection_level parameter to group settings API
  • Accepts values: no_checks, log_only, interrupt

• Feature Flag: ai_prompt_scanning (gitlab_com_derisk)

  • Controls visibility of the prompt injection protection settings

Frontend Implementation

• Vue Component (duo_workflow_settings_form.vue):

  • Added radio group for selecting protection level
  • Conditional rendering based on showProtection prop
  • Emits protection-level-change event on selection

• Visibility Logic:

  • SaaS: Displayed in Duo settings for top-level groups only
  • Self-managed: Displayed in every top-level group's Duo settings
  • Requires admin_duo_workflow permission and ai_prompt_scanning feature flag

GraphQL

The field is exposed via GraphQL:

{
  duoWorkflowWorkflows(workflowId: "gid://gitlab/Ai::DuoWorkflows::Workflow/2614") {
    nodes {
      project {
        rootGroup {
          aiSettings {
            promptInjectionProtectionLevel
          }
        }
      }
    }
  }
}

Screenshots

Self-managed instances have the setting in every top-level group Duo settings:

Click to expand

Saas display it in Duo settings for a top-level group

Click to expand