Add the dependency_firewall_malicious_packages feature flag

What does this MR do and why?

Introduces the dependency_firewall_malicious_packages feature flag — a query kill-switch (wip, default off) for the upcoming Dependency Firewall malicious-package lookup — with the minimum code needed to keep the build green.

There are no database or model changes here. The malicious-package query, its MalwareAffectedPackage scopes, and the supporting index are deferred to a follow-up MR.

Why a no-op finder rather than the flag alone

GitLab's blocking rspec:feature-flags job fails if a flag definition has no reference in production code, and its MarkUsedFeatureFlags cop ignores spec files (return if in_spec?(node)) — so a test reference does not count. The smallest valid reference is therefore a kill-switch guard in production code:

• PackageMetadata::MalwareAdvisoriesFinder#execute is a no-op that returns [] (gated by the flag) until the lookup lands.
• FetchPackageMaliciousService delegates to it (returns [] today), wiring the eventual architecture without behaviour change.

Feature flag

Flag	Type	Default	Rollout issue
dependency_firewall_malicious_packages	wip	off	#605121

Feature work item: gitlab-org#22692

What's in this MR

• config/feature_flags/wip/dependency_firewall_malicious_packages.yml — the flag
• ee/app/finders/package_metadata/malware_advisories_finder.rb — kill-switch-gated no-op finder
• ee/app/services/security/dependency_firewall/fetch_package_malicious_service.rb — minimal delegation
• specs for the finder + service, and the finder allowlist entry

No changelog entry (change is behind a default-off flag).