Remove the six labkit rack cohort feature flags

What does this MR do and why?

This MR removes six feature flags (rate_limiter_use_labkit_rack_cohort_1, _1_enforce, _2, _2_enforce, _3, _3_enforce) that orchestrated a three-cohort staged rollout of Labkit-based rate limiting to replace the legacy Rack::Attack middleware. The rollout has completed its soak period and every cohort is now unconditionally enforced in production, so this change collapses the enforcement logic by hardcoding ThrottleRegistry.fully_enforced? to true, removes the per-cohort flag-checking methods it depended on, and deletes the six flag definition files. As a side effect, the legacy Rack::Attack middleware's safelist (labkit_fully_enforced) now always short-circuits any real throttling behavior, making the legacy Rack::Attack request-path specs (spec/requests/rack_attack_global_spec.rb, ee/spec/requests/rack_attack_global_spec.rb, ee/spec/requests/rack_attack_spec.rb, and their shared examples file) dead code; this MR deletes them rather than maintaining specs that exercise nothing real anymore.

References

Two narrowly scoped pieces of cleanup discovered during review are deferred to separate follow-up MRs to keep this change focused: removing the now-unused Entry#cohort metadata (a struct field and per-entry annotations that nothing reads once the flags are gone), and adding new test coverage for Geo and Workhorse-JWT bypass behavior plus a query-count regression guard on the rejection path, which emerged as coverage gaps during review of this change but are additive and not required for this removal to be safe.

The team discussed and accepted two known trade-offs rather than fixing them here: the loss of an instant incident kill switch via feature flag (rolling back enforcement now requires a code deploy instead), and the disappearance of Rack::Attack's AuthLogger structured audit logging for throttled requests, since Labkit has no equivalent structured audit log, tracked in Include rate limit state in existing per-reques... (gitlab-com/gl-infra/production-engineering#28799 - closed).

• Issue: Remove the six labkit rack cohort feature flags (gitlab-com/gl-infra/production-engineering#29663)
• Blocks: Remove the Rack::Attack middleware from the req... (gitlab-com/gl-infra/production-engineering#29543)
• Soak rollout completed in: Default-enable the labkit rack cohort flags for... (gitlab-com/gl-infra/production-engineering#29540 - closed)

Zero-downtime upgrade safety

All six removed flags declare default_enabled: true, so hardcoding fully_enforced? to true preserves the behavior both old and new nodes already exhibit during the rollout window, eliminating any risk of divergence. The legacy Rack::Attack and new Labkit rate limiters also use disjoint Redis key namespaces, so no shared counter state requires interpretation across node versions.

Deferred cleanup

The Entry#cohort field and the cohort: values in build_meta are dead once the per-cohort enforce gate is gone. This MR keeps them in place with a doc comment marking the field as no longer read, while !253719 removes them in a follow-up.

Screenshots or screen recordings

Not applicable, this is a backend-only change with no UI impact.

How to set up and validate locally

Run the affected spec files (spec/lib/gitlab/rack_attack/labkit_rate_limit/throttle_registry_spec.rb, spec/lib/gitlab/middleware/labkit_rack_rate_limit_spec.rb, spec/lib/gitlab/rack_attack_spec.rb, spec/requests/labkit_rack_rate_limit_spec.rb, spec/requests/labkit_rack_rate_limit_fully_enforced_spec.rb, spec/requests/rack_attack_headers_spec.rb, and their EE equivalents) locally against a real GDK Postgres and Redis environment. All of them were run this way while preparing this MR and pass with no failures.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.