Add read-only Policy Store page to projects

What does this MR do and why?

This adds the plumbing for a new page under a project's Secure section, where a project will be able to see the security policies it inherits from its organization and group. Projects don't author policies themselves, so the page is read-only.

This MR is the backend half only. Nothing links to the page yet and it renders an empty container, so there is no user-visible change: the list, the sidebar entry and the data that fills them ship in the follow-up, !265278.

Details

• New route resources :policy_store, only: [:index] in ee/config/routes/project.rb, matching the group route. Index only: policies are authored at the organization or group, so there is deliberately no new, show or edit.
• New Projects::Security::PolicyStoreController, authorizing through SecurityPoliciesPermissions the same way Projects::Security::PoliciesController does — authenticate, licensed feature, experiment active, then read_govern_policy.
• New HAML view providing the container element and its data attributes. It omits new_policy_path and list_path because the project surface has neither an authoring page nor a detail page.
• Regenerated config/routing/gitlab_routes.json and ee/app/assets/javascripts/lib/utils/path_helpers/project.js from their rake tasks.
• A request spec covers the index for a maintainer, a guest, a project whose group has not opted into the experiment, and the unrouted new/show/edit paths.

Why this is needed

Organization and group levels already have a Policy Store page. Projects need a read-only view of the policies that govern them, which is https://gitlab.com/gitlab-org/gitlab/-/issues/632454. This MR lands the route, controller and view so the follow-up can be purely the list and its query, rather than one change that is half routing and half frontend.

The split is deliberate: the sidebar entry is held back with the frontend, so no one can reach a page that shows nothing.

References

• https://gitlab.com/gitlab-org/gitlab/-/issues/632454
• Follow-up that makes the page do something: !265278

Screenshots or screen recordings

Before	After
N/A	N/A

N/A on both sides: this MR adds no user-reachable UI. There is no sidebar entry, nothing else links to the route, and a user who typed the URL would get an empty container with no heading, list or empty state. The first visible state of this page is in !265278, which carries the recording.

How to set up and validate locally

1. Enable the policy_store_experiment_enabled instance setting.
2. Opt a root group in via its namespace setting (NamespaceSetting#policy_store_experiment_enabled).
3. Open <project>/-/security/policy_store for a project in that group and confirm it returns 200 with an empty #js-policy-store container.
4. Confirm <project>/-/security/policy_store/new, /1 and /1/edit return 404.
5. Confirm a Guest on the same project gets a 404, and so does a project whose group has not opted in.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.