Phase 4: Emit audit events for admin duo_availability namespace overrides

What does this MR do and why?

Implements Phase 4 of epic &22389 (Admin-locked Always off Duo/DAP availability for selected subgroups).

Adds Gitlab::Audit::Auditor.audit calls to the two namespace-override services introduced in Phase 2 (!241100 (merged)), so that every admin-locked duo_availability change is recorded in the audit log.

Changes

Ai::DuoSettings::SetNamespaceOverrideService

• Emits audit event admin_override_set_for_namespace_duo_availability after a successful save.
• Captures: actor (current_user), target namespace (as both scope and target), and the new availability value in the message.
• Only emits on success — authorization failures and validation errors produce no audit entry.

Ai::DuoSettings::ClearNamespaceOverrideService

• Emits audit event admin_override_cleared_for_namespace_duo_availability after a successful save.
• Captures: actor (current_user), target namespace, and the previous duo_availability state in the message.
• Only emits on success.

Audit event type definitions

• ee/config/audit_events/types/admin_override_set_for_namespace_duo_availability.yml
• ee/config/audit_events/types/admin_override_cleared_for_namespace_duo_availability.yml

RSpec

• Audit event emission tests added to both existing spec files.
• Tests for the no-emit path (forbidden / unauthorized) also added.

References

• Closes #603325 (closed)
• Epic: &22389
• Phase 2 MR (services): !241100 (merged)
• Implementation plan: #603135 (closed)

Screenshots or screen recordings

How to set up and validate locally

1. Enable admin mode and log in as an instance admin.
2. In a Rails console, run:

   group = Group.find_by_path('your-group')
   admin = User.admins.first
   Ai::DuoSettings::SetNamespaceOverrideService.new(
     namespace: group, current_user: admin, availability: 'never_on'
   ).execute

3. Check the audit log for the group — an admin_override_set_for_namespace_duo_availability event should appear.
4. Run the clear service and verify admin_override_cleared_for_namespace_duo_availability appears.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.