Show privacy notice for Duo mentions in non-public Slack contexts

What does this MR do and why?

Feature behavior for the Duo-in-Slack privacy notice, stacked on top of the infrastructure MR (!245954 (merged)) per reviewer suggestion on the original MR (!244130 (comment 3550890954)).

Duo-from-Slack sessions are recorded in the shared duo-workspace project and visible to everyone with access to it, which may be a wider audience than a private channel or group DM in Slack.

This MR introduces a one-time ephemeral notice when the bot is mentioned in a private channel or group DM:

• Acknowledge and continue persists the acknowledgement per user on chat_names (once per Slack workspace), removes the lock reaction from the original mention, and re-enqueues the mention so the Duo flow runs.
• Cancel dismisses the notice without persisting anything and swaps the lock reaction for an x reaction to signal the mention was intentionally not processed; the user is asked again on the next mention.

Public channels are unaffected. The channel type check fails closed: when it cannot be determined (for example, an existing app installation without the conversation read scopes), the notice is shown.

Changes relative to the original MR

Reviewer feedback from !244130 (closed) is baked in:

• Both privacy notice handlers now inherit from SlackBlockActions::BaseHandler (introduced in the infrastructure MR), removing the duplicated button-value parsing, installation lookup, and response_url message replacement (!244130 (comment 3550890942)).
• All new user-facing strings (notice text, button labels, confirmation, and cancellation messages) are externalized with s_() (!244130 (comment 3550890894)).
• The fail-closed gap for ok: true responses without channel data is fixed (carried over from the original MR).

Split plan

MR	Content
!245954 (merged)	Infrastructure foundation (database, Slack scopes/API, base handler)
This MR	Feature behavior (privacy notice, acknowledge/decline handlers)
Follow-up	Docs (requires technical writer review)

This MR targets the infrastructure branch and will be retargeted to master once that MR merges.

References

• Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/603712
• Replaces !244130 (closed)

Screenshots or screen recordings

Screenshots

How to set up and validate locally

1. Set up the GitLab for Slack app against your GDK (tunnel + app manifest, including the new channels:read, groups:read, im:read, and mpim:read bot scopes) and link your Slack user via /gitlab or a mention.

2. Enable the feature flag:

   Feature.enable(:slack_duo_agent)

3. Mention the GitLab bot in a private channel or group DM.

4. Verify the ephemeral privacy notice appears with Acknowledge and continue and Cancel buttons, and the mention gets a lock reaction.

5. Click Cancel: the notice is replaced with a cancellation message, the lock is swapped for an x, no flow runs, and mentioning again shows the notice again.

6. Click Acknowledge and continue: the lock is removed, the Duo flow runs, and subsequent mentions in non-public channels skip the notice.

7. Mention the bot in a public channel: no notice, flow runs directly.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.