Add rule list orchestration and rule-type picker (3/4)

What does this MR do?

Third of a four-MR stack that splits the dependency-firewall (DFW) rule-builder policy editor UI into layers that can be reviewed and merged one at a time. See dfw-rule-builder-mr1-substrate for the full stack overview and the feature-flag rollout plan.

Composes the rule builders from the previous MR into the card-list UI:

• rule_type_select.vue: searchable dropdown offering the three rule types, used for "Add new rule"
• rule_section.vue: wraps one rule in the shared SectionLayout card chrome, renders the matching builder, and shows a read-only warning alert (pointing the user to YAML mode) for a rule type it doesn't recognize
• rule_list.vue: renders the list of rule cards, the empty-state alert, and the "Add new rule" control

None of this is referenced anywhere yet, so merging this MR alone changes no runtime behavior.

Feature flag / rollout

Same as MR1: gated behind dependency_firewall_phase2, which is checked only in the final MR of this stack. This MR is an inert addition until that MR merges and the flag is enabled.

MR stack

• Previous: dfw-rule-builder-mr2-rule-builders (target: dfw-rule-builder-mr1-substrate)
• You are here: dfw-rule-builder-mr3-orchestration (target: dfw-rule-builder-mr2-rule-builders)
• Next: dfw-rule-builder-mr4-wiring (target: this branch; adds the dependency_firewall_phase2 gate)

Screenshots or demos

No rendered UI change from this MR alone.

Full flow testing: !251591 (merged)

How to set up and validate locally

1. Checkout dfw-rule-builder-mr3-orchestration
2. yarn jest ee/spec/frontend/security_orchestration/components/policy_editor/dependency_firewall/rule/rule_type_select_spec.js ee/spec/frontend/security_orchestration/components/policy_editor/dependency_firewall/rule/rule_section_spec.js ee/spec/frontend/security_orchestration/components/policy_editor/dependency_firewall/rule/rule_list_spec.js

Relates to

https://gitlab.com/gitlab-org/gitlab/-/work_items/616534+s