Draft: Create security policy bot with minimal access

What does this MR do and why?

Create security policy bot with minimal access

Introduce the security_policy_bot_minimal_access feature flag to allow creating security policy bots with minimal access role instead of guest role. This reduces the bot's default permissions to only what is defined in the security_policy_bot YAML role.

When enabled, bots are added with MINIMAL_ACCESS level and receive permissions solely from config/authz/roles/security_policy_bot.yml. When disabled (default), existing guest role behavior is preserved.

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #594741 (closed)