Fix self-hosted DWS TLS setting ignored in flow validation and metadata

What does this MR do and why?

On self-hosted instances, dws_flow_config_validator and flows_metadata_service were building the DWS gRPC client without passing a feature_setting. Because of that, Client.secure? was falling back to the global config default (true) instead of reading the admin's actual TLS setting from application settings. If the self-hosted DWS endpoint was plaintext, this caused an SSL WRONG_VERSION_NUMBER error.

This fix resolves a feature_setting via FeatureSettingSelectionService and passes it to both Client.url_for and Client.secure?, matching the pattern already used in DuoAgentPlatformProbe and workflows.rb.

References

#605958 (closed)

Screenshots or screen recordings

Before	After

How to set up and validate locally

Validation steps

1. Flow config validation (dws_flow_config_validator):

• Go to a project with AI Catalog enabled
• Create a new custom flow with a valid definition and make sure it saves successfully
• Now edit the flow and use a missing variable like {{data}} in the prompt. The DWS validation should catch it and return an error
• Similarly create custom agent and verify it saved correctly and when passing invalid prompt system should return error based on the DWS validation.

2. Flows metadata (flows_metadata_service):

• Open the GraphQL explorer at /-/graphql-explorer

• Run this query:

  {
    aiFlowsMetadata {
      capabilities {
        name
        metadata
      }
    }
  }
  

• It should return a list of capabilities without any errors

3. Specs:

bin/rspec ee/spec/services/ai/flows_metadata_service_spec.rb
bin/rspec ee/spec/services/ai/catalog/flows/create_service_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #605958 (closed)