Switch labkit synthetic bypass rules to :skip

What does this MR do and why?

Two commits:

1. Bumps gitlab-labkit to 2.7.0, which ships the :skip rule action (labkit-ruby!326): a matched :skip rule terminates evaluation and allows without any Redis operation; the match stays observable via calls_total{action="skip"}.
2. Switches the labkit shadow's synthetic terminating rules (bypass_header, the skip_* rules, runner_jobs, *_dry_run_bypass) from action: :allow to action: :skip.

These rules only exist to reproduce Rack::Attack's exclusion predicates as ordered terminating rules; their counters are read by nobody, yet at the current 30% shadow they are ~10.9k EVALSHA/s, ~54% of the shadow's writes to redis-cluster-ratelimiting. Removing them is what makes a 100% shadow (required for valid divergence measurement) fit in the cluster's capacity. See gitlab-com/gl-infra/production-engineering#29052 (closed).

No behavior change for requests: the middleware keys on the result action (:block), which is unchanged; classification order and matches are identical. Throttle rules keep counting (:block/:log) — those counters are the parity comparison. The gem bump is otherwise backward compatible (:skip is additive; no other labkit consumer changes).

Verification

• spec/lib/gitlab/rack_attack/ green against the released 2.7.0 gem (519 examples, 0 failures).
• Smoke tested end-to-end against a live GDK: a bypass-matched check terminates at bypass_header with zero labkit:rl:* keys written, non-bypass requests still fall through and count against the :block rule, and calls_total{action="skip"} increments.

Production verification after deploy: per-rule gitlab_labkit_rate_limiter_calls_total flips from action="allow" to action="skip" while redis_commands_total{cmd="evalsha"} on redis-cluster-ratelimiting drops by the bypass rules' share (~10.9k/s at 30% shadow).

Observability note: dashboards filtering action="allow" lose the bypass rules (rule labels unchanged); the flipped rules' limit/period gauges stop being set and go stale per process until Puma restarts.