Adds triage coverage bitmask workers and services

What does this MR do and why?

Introduce the triage coverage bitmask infrastructure: encode per-project, per-trigger type AI-triage capabilities into two integer bitmasks on security_inventory_filters.

The security inventory UI needs to filter and sort projects by triage coverage, but querying eligibility services at read time is too expensive. Instead, TriageCoverage::RecomputeService reads the current capability state from eligibility services (DependencyManagement::SecurityUpdate::Eligibility and Vulnerabilities::AiTriage::Eligibility for the other types), encodes the result into two bitmasks via CapabilityBitmask, and persists them via TriageCapabilitiesUpdateService. Two Sidekiq workers schedule and execute these bulk upserts: ScheduleUpdateWorker fans out in batches of 100 projects, and UpdateWorker invokes the recompute service.

This MR is the second in a series. The next MR wires up the call sites (scan profile attach/detach/update/delete) that trigger this recompute pipeline, so no caller in this code yet.

Changelog: added
EE: true

Query plans

upsert_all

Raw SQL

INSERT INTO "security_inventory_filters" ("project_id", "project_name", "traversal_ids", "archived", "triage_capabilities_on", "triage_capabilities_auto")
VALUES
    (1, 'Gitlab Smoke Tests', '{22}', FALSE, 5, 1),
    (2, 'Gitlab Test', '{24}', FALSE, 3, 3)
ON CONFLICT ("project_id")
    DO UPDATE SET
        "project_name" = excluded."project_name",
        "traversal_ids" = excluded."traversal_ids",
        "archived" = excluded."archived",
        "triage_capabilities_on" = excluded."triage_capabilities_on",
        "triage_capabilities_auto" = excluded."triage_capabilities_auto"
    RETURNING
        "id"

query plan

See this

 Insert on public.security_inventory_filters  (cost=0.00..0.03 rows=2 width=148) (actual time=19.386..23.505 rows=2 loops=1)
   Buffers: shared hit=149 read=75 dirtied=9
   WAL: records=14 fpi=7 bytes=49748
   I/O Timings: read=22.576 write=0.000
   ->  Values Scan on "*VALUES*"  (cost=0.00..0.03 rows=2 width=148) (actual time=0.117..0.131 rows=2 loops=1)
         Buffers: shared hit=19 dirtied=1
         WAL: records=1 fpi=0 bytes=99
         I/O Timings: read=0.000 write=0.000
Settings: effective_cache_size = '338688MB', jit = 'off', work_mem = '100MB', random_page_cost = '1.5', seq_page_cost = '4'
Query ID: -7965188553399900574

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

#629986 (closed)