Allow policy store mutations to accept a group path

What does this MR do and why?

Group-level policy store reads already work through Group.policyStore by full path, but the create, update, and delete mutations only accepted organizationId, forcing the group editor pages to use REST for writes. This MR adds an optional groupPath argument to governPolicyCreate, governPolicyUpdate, and governPolicyDelete so they can target a group directly. Exactly one of organizationId or groupPath is required; the shared concern resolves the container and the mutation authorizes against it. Services and REST endpoints are unchanged.

Closes #630064

References

• Plan comment: https://gitlab.com/gitlab-org/gitlab/-/work_items/630064#note_3878912104
• Decision on keeping policy ids as Int (not GlobalID): !250240 (merged)
• Follow-up frontend issue (switch group editor callers off REST): #630066

Input argument order in public/-/graphql/introspection_result.json moves because the container arguments now come from an argument-declaring concern. No semantic schema change beyond the two arguments.

Screenshots or screen recordings

No UI changes.

How to set up and validate locally

1. In a Rails console, enable the experiment for a root group you own:

   ApplicationSetting.current.update!(policy_store_experiment_enabled: true)
   Feature.enable(:security_policies_v2)
   group = Group.find_by_full_path("<group full path>")
   group.namespace_settings.update!(policy_store_experiment_enabled: true)

2. As the group Owner, open http://gdk.test:3000/-/graphql-explorer and run:

   mutation {
     governPolicyCreate(input: {
       groupPath: "<group full path>"
       name: "test policy"
       triggerType: "deployment_requested"
       rules: [{ type: "environment", value: { names: ["production"] } }]
     }) {
       policy { id namespaceId }
       errors
     }
   }

   Expect policy.namespaceId to be the group's id and errors to be empty.
3. Re-run the same mutation with both organizationId and groupPath set. Expect the top-level error One and only one of [organizationId, groupPath] arguments is required.
4. Run the specs:

   bundle exec rspec ee/spec/graphql/mutations/govern ee/spec/requests/api/graphql/mutations/govern

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.

🤖 Generated with Claude Code