Add rate limit to group audit events API

What does this MR do and why?

GET /groups/:id/audit_events and GET /groups/:id/audit_events/:audit_event_id currently only get the generic front-door rate limit. Any member of a group can call them (members without broader audit access only see events they authored), so the endpoints are broadly exposed. This gap came up in the WS9 endpoint rate-limit audit.

• New group_audit_events_api rate limit rule (per user, per group, one minute window), registered in the EE labkit registry and enforced in the endpoints' before block via check_rate_limit!. Admins are not exempt from this one.
• New group_audit_events_api_limit application setting, stored in the existing rate_limits jsonb column, so no migration is needed. Default is 200 requests per minute; setting it to 0 disables the limit. The default mirrors the instance and project limits and can be tuned later based on production data.
• Admin UI: a third field in the "Audit events API rate limits" section on Settings > Network. Like the project field, it is gated on the audit_events license feature, since that is what the group endpoints themselves require.
• The setting is readable and writable through the application settings API (license-gated exposure, typed as an integer param), shown on the instance configuration help page, documented in doc/administration/settings/rate-limit-on-audit-events-api.md, and added to the OpenAPI document.
• Requests over the limit return 429 and get logged to auth.log.

Note: this branch is based on !253781 (merged) and targets its branch. It should retarget to master once that MR merges.

References

Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/605429 (confidential issue)

Screenshots or screen recordings

How to set up and validate locally

1. Have an Ultimate/Premium license active in GDK.

2. As admin, go to Admin > Settings > Network, expand "Audit events API rate limits", set "Maximum requests to the GET /groups/:id/audit_events[/:audit_event_id] API per minute per user per group" to 1, and save.

3. With a personal access token of a group member, call:

   curl --header "PRIVATE-TOKEN: <token>" --url "http://gdk.test:3000/api/v4/groups/<group-id>/audit_events"

   twice within a minute.

4. The second request returns 429 Too Many Requests, and the throttle is logged in log/auth.log.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.