Add project setting for duo dependency bump breaking changes

What does this MR do and why?

Adds a project-level setting, duo_dependency_bump_breaking_changes_enabled, that controls whether the resolve_dependency_bump/experimental GitLab Duo foundational flow (AI-powered resolution of breaking changes from dependency bumps) is enabled for a project.

The setting's visibility and availability are gated behind the new duo_dependency_bump_breaking_changes beta feature flag, scoped to the top-level group (root_ancestor), and the toggle is Ultimate-only. This mirrors the existing duo_secret_detection_false_positive pattern.

References

• Related to https://gitlab.com/gitlab-org/gitlab/-/issues/603392
• Feature flag: duo_dependency_bump_breaking_changes (beta)

Screenshots or screen recordings

Before	After

Database Migration

### up
bundle exec rake db:migrate:up:main VERSION=20260618120000
main: == [advisory_lock_connection] object_id: 160580, pg_backend_pid: 68344
main: == 20260618120000 AddProjectLevelSettingDuoDependencyBumpBreakingChangesEnabled: migrating 
main: -- add_column(:project_settings, :duo_dependency_bump_breaking_changes_enabled, :boolean, {:default=>false, :null=>false})
main:    -> 0.0445s
main: == 20260618120000 AddProjectLevelSettingDuoDependencyBumpBreakingChangesEnabled: migrated (0.0513s) 

main: == [advisory_lock_connection] object_id: 160580, pg_backend_pid: 68344

### down

bundle exec rake db:migrate:down:main VERSION=20260618120000

main: == [advisory_lock_connection] object_id: 174260, pg_backend_pid: 67955
main: == 20260618120000 AddProjectLevelSettingDuoDependencyBumpBreakingChangesEnabled: reverting 
main: -- remove_column(:project_settings, :duo_dependency_bump_breaking_changes_enabled, :boolean, {:default=>false, :null=>false})
main:    -> 0.0413s
main: == 20260618120000 AddProjectLevelSettingDuoDependencyBumpBreakingChangesEnabled: reverted (0.0512s) 

main: == [advisory_lock_connection] object_id: 174260, pg_backend_pid: 67955

How to set up and validate locally

1. Ensure the project's top-level group is on an Ultimate plan and Duo features are enabled.

2. Enable the feature flag for the top-level group in the Rails console:

   group = Group.find_by_full_path('<your-top-level-group>')
   Feature.enable(:duo_dependency_bump_breaking_changes, group)

3. Visit Project → Settings → GitLab Duo and confirm the "Turn on AI-powered resolution of dependency bump breaking changes" toggle is visible.

4. Disable the feature flag and confirm the toggle is hidden and the setting is no longer exposed via the API.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.