Add setting to enable policies mergeability check

What does this MR do and why?

Adds a new project-level setting security_policy_pipeline_must_succeed that controls whether the security policy pipeline mergeability check is enforced. When enabled, all security policy pipelines (from Pipeline Execution Policies and Scan Execution Policies) must succeed before merge requests can be merged.

Previously, the security policy pipeline check (CheckSecurityPolicyPipelineStatusService) was gated only by the security_policy_pipeline_check feature flag and the security_orchestration_policies license. This MR introduces an explicit project setting so that administrators can opt in to this behavior on a per-project basis.

Changes

Database migration:

• Adds security_policy_pipeline_must_succeed boolean column (default: false) to project_settings

Backend (settings controller, model, API):

• Delegates security_policy_pipeline_must_succeed getter/setter from Project to ProjectSetting
• Exposes the setting in the REST API (GET /projects/:id and PUT /projects/:id) behind the security_orchestration_policies license and security_policy_pipeline_check feature flag
• Adds the setting as an allowed parameter in MergeRequestsController when the license and feature flag are available

GraphQL:

• Exposes securityPolicyPipelineMustSucceed field on ProjectType (experimental, milestone 18.11)

Mergeability check:

• Updates CheckSecurityPolicyPipelineStatusService#applicable? to also require security_policy_pipeline_must_succeed to be enabled on the project, making the check opt-in rather than automatic

Frontend (settings UI):

• Adds a new checkbox under Settings > Merge requests > Merge checks: "All security policy pipelines must succeed" with help text explaining the behavior
• Only rendered when the feature flag and license are available

Changelog: added EE: true

References

Related to #589650 (closed)

Screenshots or screen recordings

How to set up and validate locally

1. Enable the feature flag: Feature.enable(:security_policy_pipeline_check)
2. Ensure the project has an Ultimate license with security_orchestration_policies available
3. Navigate to Settings > Merge requests > Merge checks
4. Verify the "All security policy pipelines must succeed" checkbox is visible
5. Enable the setting and confirm it persists after saving
6. Verify the setting is exposed via the REST API (GET /api/v4/projects/:id) and GraphQL
7. Create a merge request with PEP/SEP policies configured and verify the mergeability check respects the new setting

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.