Add shared widgets for the DFW rule-builder UI (1/4)

What does this MR do?

First of a four-MR stack that splits the dependency-firewall (DFW) rule-builder policy editor UI into layers that can be reviewed and merged one at a time:

1. This MR: shared widgets and constants (substrate)
2. dfw-rule-builder-mr2-rule-builders: license, vulnerability, and malicious rule builders
3. dfw-rule-builder-mr3-orchestration: rule list and rule-type picker
4. dfw-rule-builder-mr4-wiring: wires it all into the policy editor, gated behind dependency_firewall_phase2

This MR adds the lowest layer only: rule-type, severity, and enforcement-mode constants, plus small, self-contained UI widgets (allow_deny_toggle, name_list_textarea, severity_select) that the later MRs compose. It also adds a backward-compatible searchable prop on the shared rule_multi_select component.

None of this is referenced anywhere yet, so merging this MR alone changes no runtime behavior.

Why split into 4 MRs?

The original combined branch touched 15 source files and 14 spec files across 4 layers (shared widgets, rule builders, orchestration, policy-editor wiring), each depending only on the layer below it. Splitting lets each layer get focused review instead of one large diff. Nothing here activates any new user-facing behavior until the last MR in the stack, which gates it behind a feature flag, lands.

Feature flag / rollout

The whole rule-builder UI is gated behind dependency_firewall_phase2 (see Security::DependencyFirewall::Availability.phase2_enabled? in ee/lib/security/dependency_firewall/availability.rb). The gate lives entirely in the final MR of this stack (dfw-rule-builder-mr4-wiring), so this MR and the two after it are inert additions until that MR merges and the flag is enabled.

This is WIP work built incrementally behind a flag that's currently disabled. Each MR in the stack can land as it's reviewed; the feature only becomes visible to users once all four MRs are merged and dependency_firewall_phase2 is turned on for a namespace.

MR stack

• You are here: dfw-rule-builder-mr1-substrate (target: master)
• Next: dfw-rule-builder-mr2-rule-builders (target: this branch)
• Then: dfw-rule-builder-mr3-orchestration
• Then: dfw-rule-builder-mr4-wiring (adds the dependency_firewall_phase2 gate)

Screenshots or demos

No rendered UI change from this MR alone.

Full flow testing: !251591 (merged)

How to set up and validate locally

1. Checkout dfw-rule-builder-mr1-substrate
2. yarn jest ee/spec/frontend/security_orchestration/components/policy_editor/dependency_firewall/rule/allow_deny_toggle_spec.js ee/spec/frontend/security_orchestration/components/policy_editor/dependency_firewall/rule/name_list_textarea_spec.js ee/spec/frontend/security_orchestration/components/policy_editor/dependency_firewall/rule/severity_select_spec.js ee/spec/frontend/security_orchestration/components/policy_editor/rule_multi_select_spec.js

https://gitlab.com/gitlab-org/gitlab/-/work_items/616534+s