Create push pipelines for approval policy bypass

What does this MR do and why?

A push to a protected branch that is permitted through an approval policy's bypass_settings succeeded, but no push pipeline was created. The push path consults the bypass (EE::Gitlab::Checks::BranchCheck) while the pipeline-creation path did not, so the post-receive pipeline failed its ref check and — because push pipelines are created with save_incompleted: false — was silently discarded with no error surfaced.

This mirrors the bypass decision in the pipeline ability chain (Chain::Validate::Abilities#allowed_to_run_pipeline?) so a bypassed push gets its pipeline. An audit: flag is threaded through the bypass checker so the pipeline path reuses the same decision without re-emitting the compliance audit event the push path already logged.

References

#601219 (closed)

How to set up and validate locally

Ultimate license required.

1. Create a project with a .gitlab-ci.yml on the default branch, and protect that branch so pushes require the Maintainer role.
2. Create a project access token with the Developer role.
3. Add an approval policy whose bypass_settings lists that token, e.g. bypass_settings: { access_tokens: [{ id: <token_id> }] }.
4. Using the token, push a commit to the protected branch (the policy bypass allows the push to land).
5. Open the project's Build > Pipelines page.
   • Before: the push succeeds but no pipeline is created for the new commit.
   • After: a push pipeline runs for the new commit.