Accept eight additional ecosystems in the dependency firewall evaluate endpoint

What does this MR do and why?

We expand the POST /projects/:id/dependency_firewall/evaluate endpoint to accept seven additional ecosystem values: composer, conan, golang, nuget, cargo, swift, and pub. The endpoint now accepts eleven ecosystems in total.

The change is a one-line extension of Security::DependencyFirewall::EvaluatePackageService::ECOSYSTEMS. The Grape endpoint reads its values: allow-list from the same constant, so the transport layer picks up the new values without further edits. The downstream metadata layer (license, vulnerability, and malicious-package lookups) already handles these seven PURL types via Enums::Sbom::PURL_TYPES and the existing package-metadata sync configuration.

Name normalization is unchanged. Sbom::PackageUrl::Normalizer still downcases golang and applies PEP-503 normalization for pypi. Other ecosystems pass through verbatim, matching what the metadata ingester stores; the client submits the canonical form, as with Maven today. The endpoint remains behind the dependency_firewall_phase1 feature flag and keeps its hidden true and :experiment lifecycle settings in Grape, so the expanded list ships under the same experimental status.

How to set up and validate locally

1. In a GDK Rails console, enable the flag for your project: Feature.enable(:dependency_firewall_phase1, Project.find(<id>)).

2. Call the endpoint with one of the new ecosystem values:

   curl --request POST \
     --header "PRIVATE-TOKEN: <token>" \
     --header "Content-Type: application/json" \
     --data '{"ecosystem":"cargo","name":"serde","version":"1.0.0"}' \
     "http://gdk.test:3000/api/v4/projects/<id>/dependency_firewall/evaluate"

3. Confirm the response returns a verdict (allowed or blocked) rather than a 400 ecosystem does not have a valid value error.

4. Repeat with composer, conan, golang, nuget, swift, and pub to confirm each is accepted.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.

Scope note: contract expansion on an existing experimental endpoint. No schema changes, no new feature flag, no new dependencies.