Remove allow/deny toggle from DFW license rule UI

What does this MR do?

Removes the allow/deny radio buttons from the Dependency Firewall license rule UI. License rules always deny now — the choice was only ever shown because it existed in the underlying YAML schema, not because it was meant to be a UI toggle.

Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/629588

Existing allow-list rules

The backend and schema still fully support allowed license rules authored in YAML, and that isn't changing. A rule created or edited through the visual builder always writes denied. If an existing rule already has an allowed list (authored via YAML), this MR keeps it editable as a multi-select in the visual builder and shows an inline GlAlert explaining it's a legacy allow list, rather than hiding that context.

Screenshots or screen recordings

before:

after:

How to set up and validate locally

Dependency Firewall rule mode needs three things enabled (see ee/lib/security/dependency_firewall/availability.rb): the feature flag, an Ultimate license, and the dependency_firewall_enabled setting. On GDK:

bin/rails runner 'Feature.enable(:dependency_firewall_phase1)'
bin/rails runner 'Gitlab::CurrentSettings.update!(dependency_firewall_enabled: true)'

Confirm all three are on:

bin/rails runner '
puts Feature.enabled?(:dependency_firewall_phase1, nil)
puts License.feature_available?(:dependency_firewall)
puts Gitlab::CurrentSettings.dependency_firewall_enabled
'

If the license line prints false, your GDK doesn't have an Ultimate license; seed one before continuing (gitlab-org/customers-gitlab-com license seeding docs, or License.current should already report ultimate on most GDK setups).

Then, to see the rule builder:

1. Go to a project (or its group) → Secure > Policies.
2. Create or edit a Dependency Firewall policy.
3. Add a rule of type License.
4. Confirm no allow/deny toggle is shown, and the rule always saves as a deny list.

To see the legacy allow-list alert:

1. Edit the same policy's YAML directly (the .yaml mode toggle in the policy editor) and add a license rule with allowed: instead of denied:, e.g.:

   - type: license
     allowed:
       - name: MIT

2. Switch back to rule mode and reopen that rule — the GlAlert explaining it's a legacy allow list should show, and the license multi-select stays editable.