Add audit event for blocked secret push protection pushes

What does this MR do and why?

Emits an audit event when Secret Push Protection blocks a push:

• Adds the spp_push_blocked audit event definition
• Logs the audit event from both SPP blocking paths, with the ref and the detected findings
• Updates audit event documentation and Secret Push Protection documentation
• Updates specs for the new audit logging behavior

That helps security teams get a central record of blocked pushes for compliance reporting and SIEM forwarding.

Until now only bypassing secret push protection was audited.

Notes

(1) Secrets in blobs that cannot be mapped to a commit and a file path are left out of the findings list, so the list can under-report. Maybe we should include them with a null commit_id and file_path? I will wait for the groupsecret detection reviewer to weigh in on this.

(2) The event is project scoped, like every other Secret Push Protection audit event. It reaches the project audit events page, instance audit events page, and the instance and group streaming destinations, but not a group's audit events page. See the discussion on the issue.

References

Resolves #601632 (closed).

MR acceptance checklist

I have evaluated this MR against the MR acceptance checklist.