Add feature flag for duo-cli binary vs npm installation

What does this MR do and why?

Introduces the duo_agent_platform_executor_binary feature flag to control how duo-cli is installed in CI workloads.

• When enabled: downloads a pre-compiled binary directly from the GitLab Package Registry using curl, eliminating the Node.js/npm dependency and fragile PATH manipulation.
• When disabled (default): falls back to the legacy npm install -g @gitlab/duo-cli approach.

This allows a safe, gradual rollout of the binary install approach from !238715 (merged) (which was reverted) without breaking existing environments.

Why a feature flag?

The binary install approach was merged in !238715 (merged) but reverted due to pipeline issues. Wrapping it in a feature flag lets us:

1. Re-land the binary install logic safely
2. Enable it incrementally per-project/group
3. Roll back instantly by disabling the flag if issues arise

References

• Closes #600436 (closed)
• Original MR: !238715 (merged) (merged then reverted)

How to set up and validate locally

When skipped:

1. Test that the installation process is skipped when both duo_workflow_use_hardened_image and duo_agent_platform_executor_binary are on.
2. Test that the installation process is skipped when duo_workflow_use_hardened_image is on and duo_agent_platform_executor_binary is off.

When a custom image without the sandbox:

1. Test that the binary package is installed when a custom image is used and duo_agent_platform_executor_binary is on.
2. Test that the npm package is installed when a custom image is used and duo_agent_platform_executor_binary is off.

Keeping the old logic:

1. Test that the npm package is installed when duo_workflow_use_hardened_image is off and duo_agent_platform_executor_binary is off.

When failing (expected, thus we introduce the FF):

1. Test that the binary package is failing when duo_workflow_use_hardened_image is off and duo_agent_platform_executor_binary is on.