Bump Duo CLI to 9.30.0 and DAP workflow image to v0.0.23

What does this MR do and why?

Bumps StartWorkflowService::DUO_CLI_VERSION from 9.29.0 to 9.30.0 and IMAGE_PATH from workflow-generic-image:v0.0.22 to v0.0.23, the image tag that ships Duo CLI 9.30.0 (gitlab-org/duo-workflow/default-docker-image!56 (merged)).

The workflow-generic-image pre-installs a pinned duo-cli, and CI jobs skip the CLI download when the image already has duo, so both pins move together: IMAGE_PATH for the default image, DUO_CLI_VERSION for custom images that still download the binary.

Also brings the pinned-versions tables in doc/user/duo_agent_platform/flows/execution/images.md up to date; they were still at 9.27.0.

Draft until default-docker-image!56 is merged and tagged; the tag will be confirmed (or corrected) then.

References

• Duo CLI release: https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/releases/v9.30.0
• Image bump: gitlab-org/duo-workflow/default-docker-image!56 (merged)
• Previous bumps of the same shape: !257639 (merged), !261168 (merged)

Screenshots or screen recordings

N/A — constant and docs change.

How to set up and validate locally

1. Check out this branch and restart Rails.
2. Trigger a CI-run flow (for example assign an issue to Duo Developer, or start a Duo Code Review).
3. In the job log, confirm duo-cli already present, skipping installation and that duo --version reports 9.30.0.

Tested in an example project here: !261426 (comment 3996258355)

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.