Add the policy engine dispatch rules and audit executor

What does this MR do and why?

Adds the rules the evaluation service dispatches by, and the one executor it dispatches to.

ActionCatalog maps an authored action to its executor and whether it needs enforce mode. EnforcementState derives the state of an enforcement row from one decision and its outcomes. LogAuditTrailExecutor writes one govern_policy_violation_detected audit event per matched decision. It only observes state, so it runs in every enforcement mode. block has a catalogue entry without an executor because the settings write fence consumes its decisions at the save point.

Second of three MRs that split !261560 (merged), after the vocabulary in !263546 (merged) and before the evaluation service itself. It retargets as the stack merges. Nothing calls this code yet.

References

• Issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/630148
• Epic: https://gitlab.com/groups/gitlab-org/-/work_items/23462

Screenshots or screen recordings

Backend-only change, no UI.

How to set up and validate locally

Check that the new audit event type appears:

Gitlab::Audit::Type::Definition.get('govern_policy_violation_detected')

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.