Pass an Apollo provider to group approval settings

What does this MR do and why?

Passes an apolloProvider to the group approval settings app, the same way the project approval settings app already does.

PolicyOverrideWarningIcon loads security policies with an apollo: query. In the group app, no provider reached it:

• Vue 2: vue-apollo v3 skips the query when there is no provider. securityPolicies stays empty, so the policy override warning never shows on group settings. The failure is silent.
• Vue 3: $apollo is undefined. The new development check in !260635 (merged) reports it, and ee/spec/features/groups/group_settings_spec.rb fails on the console error.

The module also calls Vue.use(VueApollo) at module scope, so the install runs before the app is created on Vue 3.

Users who cannot read security policies get an empty list, not an error. Security::SecurityPolicyBaseFinder#execute returns [] for them, so this change adds no new alert.

References

• Found by the plugin check in !260635 (merged) (pipeline https://gitlab.com/gitlab-org/gitlab/-/pipelines/2925759169, job https://gitlab.com/gitlab-org/gitlab/-/jobs/17024946173)
• Query moved into the component in !233006 (merged)
• Same bug class as !259575 (merged)

Screenshots or screen recordings

Not captured. The icon appears only when a security policy overrides approval settings.

How to set up and validate locally

1. Use a group with an Ultimate license and a merge request approval policy that overrides an approval setting.
2. Visit Group > Settings > General and expand Merge request approvals.
3. Confirm the policy override warning icon appears next to the approval settings heading.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code