Draft: Add Geo/Workhorse-JWT and rejection-path query coverage for labkit

What does this MR do and why?

The parent merge request deletes the legacy Rack::Attack request specs because the labkit safelist now permanently short-circuits Rack::Attack before those specs' assertions run. Two important code paths were covered only by those deleted specs: the Geo and Workhorse-JWT safelist bypass, and a query-count guard on the rejection path. This MR restores coverage by adding comprehensive Geo/Workhorse-JWT bypass tests to the EE labkit request spec (covering valid Workhorse JWT exemption, missing JWT throttling, invalid JWT throttling, cross-path JWT throttling, valid Geo JWT bypass, and invalid Geo JWT throttling), and adds a query-count regression guard on the labkit rejection path to the CE request spec.

References

The legacy specs deleted in the parent merge request were dead, since the safelist short-circuits Rack::Attack before they assert anything. The coverage gap they left was identified during review of that MR, and is closed here rather than there so the parent stays focused on the flag removal.

• Tracking issue: Remove the six labkit rack cohort feature flags (gitlab-com/gl-infra/production-engineering#29663)
• Parent merge request (branch target): Draft: Remove the six labkit rack cohort featur... (!256308)

Screenshots or screen recordings

Not applicable. This is a test-only change with no user-facing code modifications.

How to set up and validate locally

Run the CE and EE request spec suites against a real Postgres and Redis GDK environment. All 66 examples pass. Run RuboCop on the 2 changed files; no issues reported.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.