Add foundations for Duo tool approvals in messaging adapters

What does this MR do and why?

First of three MRs that let a user approve or deny a paused Duo agent's tool call from Slack. This one adds the building blocks and changes no behaviour:

• Ai::DuoWorkflows::PendingToolApproval reads the trailing run of request entries from a paused session's ui_chat_log and exposes the pending tool calls plus a fingerprint keyed on their message_ids, so a later decision can be matched against exactly the request it was made for.
• Slack::Api#post_ephemeral accepts blocks:, so ephemerals can carry Block Kit content.

Nothing calls any of this yet. The Base#on_approval_required hook this MR originally added has since landed on master via !255163 (merged), together with the CallbackWorker dispatch.

Stack:

1. This MR — foundations
2. Post the approval request and open the review modal — !255537 (merged)
3. Resolve the decision from the modal — !255538 (merged)

Split out of !254849 (closed) following review feedback there.

References

• Issue: #628438
• Epic: &23521

Screenshots or screen recordings

No user-facing changes.

How to set up and validate locally

Covered by specs:

bin/rspec ee/spec/models/ai/duo_workflows/pending_tool_approval_spec.rb spec/lib/slack/api_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.