Draft: POC Add risk_severity rule builder UI behind a feature flag

Hannah Bakerrequested to merge
poc-dfw-risk-severity-rule into master

What does this MR do?

Wires the risk_severity Dependency Firewall rule type (per-severity vulnerability count thresholds, backend already shipped in gitlab-org/gitlab#617114) into the DFW policy editor's rule-builder UI.

Behind the dependency_firewall_risk_severity_rule feature flag: when enabled, "Risk severity" replaces "Vulnerability" in the "Add new rule" dropdown; when disabled, the editor behaves exactly as it does today. License and Malicious package are unaffected either way.

Closes gitlab-org/gitlab#627719

Screenshots or screen recordings

Verified live in a local GDK: flag on/off correctly swaps the dropdown option, adding/removing severity rows works, threshold values sanitize to non-negative integers, and the resulting policy YAML validates against the schema end-to-end via the real "Configure with a merge request" save flow.

How to set up and validate locally

  1. Enable the flag: Feature.enable(:dependency_firewall_risk_severity_rule)
  2. Go to a project's Security > Policies > New policy > Dependency Firewall
  3. Click "Add new rule" — "Risk severity" appears instead of "Vulnerability"
  4. Add a rule, add a few severities with thresholds, save

Merge request reports