Add gitlab-advanced-sast-ext job to SAST CI templates

What does this MR do and why?

Adds the gitlab-advanced-sast-ext analyzer job to both SAST CI/CD templates (Jobs/SAST.gitlab-ci.yml and Jobs/SAST.latest.gitlab-ci.yml), now that the gitlab-advanced-sast-ext image is published ($SECURE_ANALYZERS_PREFIX/gitlab-advanced-sast-ext).

Modeled on !205649 (merged) (which added gitlab-advanced-sast-cpp). The job is opt-in, off by default, enabled with GITLAB_ADVANCED_SAST_EXT_ENABLED=true, and runs alongside the existing analyzers (it does not suppress semgrep-sast).

This MR also includes the offline-deployment support (originally !246469 (merged), since merged in): the gitlab-advanced-sast-ext job in Secure-Binaries.gitlab-ci.yml and the offline image list in the SAST docs.

Changes

• lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml + .latest: add .gitlab-advanced-sast-ext-exist-rules and the gitlab-advanced-sast-ext job (same 3-block MR/branch rule structure as gitlab-advanced-sast-cpp).
• ee/spec/.../sast_gitlab_ci_yaml_spec.rb + .latest: add enabled/disabled coverage rows for the languages SAT supports (Swift, Objective-C, Objective-C++).
• ee/spec/services/.../ci_action/template_spec.rb: add gitlab-advanced-sast-ext-0 to the SAST scan-execution-policy job list.
• lib/gitlab/ci/templates/Security/Secure-Binaries.gitlab-ci.yml + ee/spec/.../secure_binaries_ci_yaml_spec.rb: add the gitlab-advanced-sast-ext offline image download job (no SECURE_BINARIES_IMAGE_NAME override needed, job name matches the image name).
• doc/user/application_security/sast/_index.md: add gitlab-advanced-sast-ext to the offline analyzer image list.

Decisions to confirm (reviewers)

These were chosen to mirror the clangsa pattern; please confirm:

• Enable flag: GITLAB_ADVANCED_SAST_EXT_ENABLED (opt-in, default off).
• Image tag: SAST_ANALYZER_IMAGE_TAG: 0 (floating major). Published tags today are 0, 0.1 … 0.6.1, plus edge and latest; the floating 0 currently resolves to 0.6.1.
• File globs (exist rules): *.swift,*.m,*.mm — SAT ships bindings only for Swift and Objective-C/Objective-C++.
• License gate: $GITLAB_FEATURES =~ /\bsast_advanced\b/, same as gitlab-advanced-sast-cpp.
• Runs alongside semgrep-sast (no dedup/suppression) — matching the clangsa approach.

Reference

• Model MR: Add cpp-gitlab-advanced-sast to SAST templates ... (!205649 - merged) • Hua Yan • 18.5
• SAT rollout epic: gitlab-org&21952+s

Testing

Re-verified after the next-gen-sast → gitlab-advanced-sast-ext rename (a brief gitlab-advanced-sast-mobile proposal was cancelled; the registry now publishes under the new name). A downstream MR in the iGoat-Swift demo project includes this MR's renamed Jobs/SAST.gitlab-ci.yml (via include:project:ref:) and sets GITLAB_ADVANCED_SAST_EXT_ENABLED: 'true':

• Verification MR: https://gitlab.com/gitlab-org/secure/tests/sat-demo/igoat-swift/-/merge_requests/3
• Pipeline: https://gitlab.com/gitlab-org/secure/tests/sat-demo/igoat-swift/-/pipelines/2710504088
• Job: https://gitlab.com/gitlab-org/secure/tests/sat-demo/igoat-swift/-/jobs/15564686040

Check	Result
gitlab-advanced-sast-ext job created (rules + Swift/Objective-C exists globs match)	✅ appears alongside semgrep-sast and gitlab-advanced-sast
Job starts and pulls the image	✅ registry.gitlab.com/security-products/gitlab-advanced-sast-ext:0 resolves and pulls
Job completes	✅ success in 25.3s (job duration), produced a valid GitLab SAST report (gl-sast-report.json: 297 vulnerabilities)

This confirms the renamed template correctly starts gitlab-advanced-sast-ext on a real Swift/Objective-C project when enabled.

The published :0 image is currently v0.6.1, whose analyzer id is still sat (its banner reads "SAT (Static Analysis Toolkit)"). The report/ruleset id becomes gitlab-advanced-sast-ext once the analyzer-side rebrand (static-analysis-toolkit!209) is released.