Add rate limit to project audit events API

What does this MR do and why?

GET /projects/:id/audit_events and GET /projects/:id/audit_events/:audit_event_id currently only get the generic front-door rate limit. Any user with at least the Developer role on a project can call them, which makes this the most exposed of the audit event API endpoints. This gap came up in the WS9 endpoint rate-limit audit.

This MR adds a dedicated, configurable rate limit for the endpoint, following the same pattern used for the instance audit events API limit in !248055 (merged):

• New project_audit_events_api rate limit rule (per user, per project, one minute window), registered in the EE labkit registry and enforced in the endpoint's before block via check_rate_limit!. Admins are not exempt from this one.
• New project_audit_events_api_limit application setting, stored in the existing rate_limits jsonb column, so no migration is needed. Default is 200 requests per minute; setting it to 0 disables the limit. The default mirrors the instance limit and can be tuned later based on production data.
• Admin UI: a second field added to the existing "Audit events API rate limits" section on Settings > Network, which was added by the instance MR. The instance limit is gated on the admin_audit_log license feature. This new field is gated on audit_events instead, since that's what the project endpoint itself requires. The section renders if either feature is licensed, and each field shows or hides on its own.
• The setting is readable and writable through the application settings API (license-gated exposure, typed as an integer param), shown on the instance configuration help page, documented in doc/administration/settings/rate-limit-on-audit-events-api.md, and added to the OpenAPI document.
• Requests over the limit return 429 and get logged to auth.log.

References

Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/605430 (confidential issue)

Instance endpoint precedent: !248055 (merged)

Screenshots or screen recordings

How to set up and validate locally

1. Have an Ultimate/Premium license active in GDK.

2. As admin, go to Admin > Settings > Network, expand "Audit events API rate limits", set "Maximum requests to the GET /projects/:id/audit_events[/:audit_event_id] API per minute per user per project" to 1, and save.

3. With a personal access token of a user with at least the Developer role on a project, call:

   curl --header "PRIVATE-TOKEN: <token>" --url "http://gdk.test:3000/api/v4/projects/<project-id>/audit_events"

   twice within a minute.

4. The second request returns 429 Too Many Requests, and the throttle is logged in log/auth.log.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.