Coerce nil import_sources to an empty array

What does this MR do and why?

The import_sources column is nullable with no default, so legacy rows can have a NULL value. ApplicationSetting declared it without type: Array, which caused NULL to deserialize as nil instead of [].

Several call sites call .include? directly on the value (an admin settings helper, ApplicationController methods, and import API endpoints), so a nil value raised NoMethodError across all of them.

Adding type: Array matches the pattern already used by sibling settings (disabled_oauth_sign_in_sources, domain_allowlist, domain_denylist) and coerces a NULL column value to [] on load.

References

Closes #581573 (closed)

How to set up and validate locally

Reproduce the bug (before the fix):

1. Revert this MR's change locally.
2. In a Rails console, set import_sources to NULL:

   UPDATE application_settings SET import_sources = NULL;

3. Restart GDK.
4. Navigate to Admin > Settings > General > Import and export settings — a NoMethodError is raised.

Validate the fix:

1. Apply this MR's change.
2. Set import_sources to NULL as above and restart GDK.
3. Navigate to Admin > Settings > General > Import and export settings — the page loads without error and all importers appear unchecked.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.