Default-enable the labkit rack cohort flags for self-managed

What does this MR do and why?

Brings self-managed in line with GitLab.com by default-enabling the six labkit rack cohort flags. GitLab.com has been labkit-only since 2026-08-12; self-managed still runs Rack::Attack as the enforcer with labkit dormant.

The flags were type: wip, which must not be default_enabled: true (docs). They move to beta, which is the only type whose constraints allow a permanent default-on release. type: :wip in throttle_registry.rb is updated to match.

Rollout issue already exists: #602804

One user-visible change for self-managed admins: labkit uses TTL-based fixed windows instead of Rack::Attack's clock-aligned windows, so clients bursting right at the limit boundary are blocked somewhat more strictly. Aggregate parity was verified on GitLab.com before cutover.

Draft while the pipeline runs, since flipping these defaults changes behaviour in specs that don't go through spec/support/rate_limiter_labkit_rack_shadow.rb.

References

Closes gitlab-com/gl-infra/production-engineering#29540 (closed)