Add business_impact scope to security policies

What does this MR do and why?

This change adds support to scope security policies using security attributes from the "business impact" category.

Previously, security policies could be scoped to specific projects, groups, or compliance frameworks. Now policies can also be configured to include or exclude projects based on their business impact classification (like "Critical" or "High").

References

Related to: #589342 (closed)

How to set up and validate locally

1. Create a new project
2. Add a .gitlab-ci.yml file with the content:

include:
- template: Jobs/SAST.gitlab-ci.yml

2. Go to Secure > Security Configuration
3. Select Security attributes
4. Click on Edit project security attributes
5. Select Mission Critical
6. Go to Secure > Policies
7. Click on New policy
8. Select Merge request approval policy
9. Create a policy to block new vulnerabilities on Mission Critical projects
10. Get the security_attribute id

category = Security::Category.where(template_type: "business_impact")
Security::Attribute.where(security_category: category).where(name: "Mission Critical").first

11. Create a policy like

approval_policy:
  - name: Test
    description: ''
    enabled: true
    rules:
      - type: scan_finding
        branches: []
        vulnerabilities_allowed: 0
        severity_levels: []
        vulnerability_states: []
        scanners: []
    policy_scope:
      business_impact:
        including:
          - id: 1
    actions:
      - type: require_approval
        approvals_required: <security_attribute_id>
        role_approvers:
          - developer

6. Click on Create new project with the new policy
7. Merge the MR to add the policy
8. Go back to the project created in step 1
9. Create a MR adding the file vuln.rb with the content

class RunScript
  def run_script
    system("cat #{params[:path]}") 
  end
end

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.