Add rate limit to instance audit events API

What does this MR do and why?

GET /api/v4/audit_events (and GET /api/v4/audit_events/:id) had no application-level rate limit, only the generic front-door throttle. The endpoint is admin-only, available on Premium and Ultimate, and heavily polled by SIEM integrations, so a runaway poller could load the instance unchecked (gap EP-069 from the WS9 endpoint rate-limit audit).

This MR adds a dedicated, configurable limit:

• New audit_events_api rate limit rule (per user, 1 minute window) in the EE labkit registry, enforced in the endpoint before block via check_rate_limit!. Admins are deliberately not exempt - every caller of this endpoint is an admin, so an exemption would make the limit a no-op.
• New audit_events_api_limit application setting stored in the rate_limits jsonb column (no migration). Default is 200 requests per minute per user, 0 disables the limit. The default follows groups_api_limit (closest precedent: settings-backed list endpoint, 1 minute window); the WS9 spreadsheet does not prescribe a threshold, so this may be tuned based on production data before or after merge.
• Admin UI: new "Audit events API rate limits" section on Settings > Network, gated by the admin_audit_log license feature. This also creates the _ee_network_settings partial that the CE network page already referenced via render_if_exists.
• The setting is readable and writable through the application settings API (license-gated entity exposure, typed integer param), shown on the instance configuration help page, and included in the regenerated OpenAPI document.

The admin settings doc page is included here (rather than in the docs MR) because the haml-lint DocumentationLinks check requires the help_page_path target to exist on this branch. Cross-references from the existing API/rate-limit docs are in a separate docs-only MR (!248057 (merged)), blocked on this one.

Default limit selection notes

The endpoint is used by SIEM for polling instance audit events.

On gitlab the current traffic is nearly 0 ops/s, predominantly 4xx. 6 month ago it was 9 ops/s but I could not verify what was the status because data cuts off earlier. There's no way to get information about self-hosted and dedicated poll rates, the default value gives around 8M calls per month which seems to be sufficient. If it is not, admin will be able to increase via the introduced setting.

References

• Resolves https://gitlab.com/gitlab-org/gitlab/-/issues/605428
• Parent audit issue: https://gitlab.com/gitlab-org/gitlab/-/issues/605334

Screenshots or screen recordings

How to set up and validate locally

1. Make sure GDK has a Premium or Ultimate license (the section and the limit are gated by the admin_audit_log license feature).

2. Visit Admin > Settings > Network, expand Audit events API rate limits, set the limit to 2 and save.

3. As an admin with a PAT, call the endpoint three times within a minute:

   for i in 1 2 3; do
     curl --silent --output /dev/null --write-out "%{http_code}\n" \
       --header "PRIVATE-TOKEN: <admin-token>" \
       --url "http://gdk.test:3000/api/v4/audit_events"
   done

4. The third request returns 429 with a Retry-After header; requests from a different admin are unaffected.

5. Set the limit to 0 and verify the endpoint is no longer throttled.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.