Add the governance ceiling switch to the Duo Workflow token claim

What does this MR do and why?

Part of https://gitlab.com/gitlab-org/gitlab/-/issues/608968. Rollout issue: https://gitlab.com/gitlab-org/gitlab/-/issues/630713.

This adds the feature flag duo_workflow_governance_ceiling (type wip, default off).

When the flag is on for the root namespace, Rails adds ceiling: true inside the tool_access_policies claim of the Duo Workflow Service token. When it's off, the claim is unchanged. Ungoverned sessions (empty claim) never get the field.

The field is added in both places Rails builds that claim:

• Ai::DuoWorkflows::ConnectionConfigService#tool_access_policies, used by IDE, CLI and chat sessions through Workhorse.
• Ai::DuoWorkflow::DuoWorkflowService::Client#metadata, reached from WorkflowContextGenerationService#generate_workflow_token, used for tokens for CI runs. This path only asks for the field when governance is resolved for the token.

Why a signed claim and not a feature flag header

A header can be dropped by a client or a CI job that holds a DWS token, which would turn the ceiling off. The claim is signed, so it can't be dropped or forged. Older Duo Workflow Service versions ignore the unknown field.

Impact

On its own this changes nothing. The Duo Workflow Service only acts on ceiling once gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!6749 (merged) and gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!7453 (merged) land. This MR can merge independently.

Client#initialize now has 9 keyword arguments, so Metrics/ParameterLists is disabled inline with a reason.

Specs

• Flag on and flag off for each path.
• "Governance not resolved" for the CI path.
• Each new line was mutation-checked: removing it makes a spec fail.

How to set up and validate locally

1. Enable the flag for a group:

   Feature.enable(:duo_workflow_governance_ceiling, Group.find_by_full_path('<group>'))

2. Start a Duo session in a project of that group, with tool rules configured.

3. Decode the Duo Workflow Service token. Its tool_access_policies claim contains "ceiling":true.

4. Disable the flag and start a new session. The field is gone.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.