Add Authn::OauthApplication as feature flag actor

What does this MR do?

Sets up the Rails-side infrastructure for AUTH-011 (gradual rollout of routing OAuth requests through Workhorse to the IAM Auth Service). This MR is the first in a series and is intentionally narrow: it defines the feature flag and the predicate that future code will check. No request handling changes yet.

Scope of this MR

• Registers Authn::OauthApplication in Feature::SUPPORTED_MODELS so OAuth application instances can act as feature-flag actors.
• Includes FeatureGate on the model so flipper_id is exposed in the canonical "Authn::OauthApplication:<id>" form.
• Adds the proxy_oauth_requests_to_iam_service feature flag (gitlab_com_derisk, default off). Issue 594504, rollout work item 600271.
• Adds Authn::OauthApplication#iam_routing_enabled?, a predicate that wraps the flag check on the application actor. Future callers ask the routing question through this method rather than the FF symbol directly.

The flag is keyed on the OAuth application so rollout can be controlled per client: individual applications, percentage of applications, or a global on/off.

What this MR does NOT do

• Does not route any OAuth traffic to the IAM Auth Service.
• Does not add any HTTP endpoint that Workhorse can call.
• Does not change Workhorse behavior.

With default_enabled: false and no production callers, this MR is a behavioral no-op in every environment. Safe to merge on its own.

What's coming next

This is part of a sequence that delivers AUTH-011 incrementally:

MR	What it adds
This one	FF YAML, actor type, iam_routing_enabled? predicate
Next (Rails)	Oauth::IamRoutingController#pre_authorize — Workhorse-callable endpoint that returns the routing decision for an OAuth request
Workhorse skeleton	The iamproxy package wiring (already merged as Draft !236231 (merged))
Workhorse token-prefix routing	Stateless routing for giat_ / ory_ token prefixes
Workhorse FF-gated routing	Per-application routing via the PreAuthorize endpoint
Cleanup MR	Remove FF + cutover to IAM-only

• Tracking issue: #594504 (closed)
• Rollout issue: gitlab-org/gitlab/-/work_items/600271
• Workhorse skeleton: !236231 (merged)

Verification

• bundle exec rspec spec/models/authn/oauth_application_spec.rb — 4 new specs covering FF actor registration and the iam_routing_enabled? predicate. All pass.
• Console smoke-tested: app.iam_routing_enabled? returns false by default, true after Feature.enable(:proxy_oauth_requests_to_iam_service, app), and only for the targeted application.

Checklist

• FF YAML in config/feature_flags/gitlab_com_derisk/
• Authn::OauthApplication registered in Feature::SUPPORTED_MODELS
• Model includes FeatureGate
• Predicate iam_routing_enabled? added (with exclusion list entry until consumer ships)
• Specs added
• introduced_by_url and rollout_issue_url filled in the YAML