Add group support to GraphQL PoliciesResolver

What does this MR do and why?

Adds group support to the GraphQL PoliciesResolver, allowing the list page to fetch group-scoped policies via GraphQL.

This is MR 3 of 4 splitting the group-scoped policy store access work from !252678 (closed).

How to set up and validate locally

1. Enable the feature flag and experiment settings in Rails console:

   Feature.enable(:security_policies_v2)
   ApplicationSetting.current.update!(policy_store_experiment_enabled: true)

2. Enable the experiment for your group's organization and namespace:

   group = Group.find_by_full_path('your-group')
   Organizations::OrganizationSetting.for(group.organization_id).update!(policy_store_experiment_enabled: true)
   NamespaceSetting.find_or_initialize_by(namespace_id: group.id).update!(policy_store_experiment_enabled: true)

3. Query via GraphiQL (/-/graphql-explorer) as a group owner:

   {
     group(fullPath: "your-group") {
       policyStore {
         policies {
           id
           name
           triggerType
           namespaceId
         }
       }
     }
   }

4. Verify non-owners get null for policies

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

References

• Work item: #627175
• Parent MR: !252678 (closed)
• MR 1 (merged): !253003 (merged)
• MR 2 (REST endpoints): !254842 (merged)