Add epic confidentiality attribute and model validations

What does this MR do?

• adds confidential attribute to Epic model (usage will be similar to confidentiality issues)
• adds validations to Epic and Issue models to assure that confidential epic can contain only confidential issues and subepics, this means that:
  • it's not possible to change epic to confidential if it contains not-confidential issues/sub-epics
  • it's not possible to turn off issue confidentiality if it's assigned to a confidential epic
  • it's not possible to assign confidential epic to not-confidential issue
  • it's not possible to assign confidential parent epic to not-confidential issue

Note that confidentiality can not be set yet - this will be allowed in a separate MR which will expose thsi attribute in our APIs.

Related to #197339 (closed)

Migration output

https://gitlab.com/snippets/1960082

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers
• Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• Label as security and @ mention @gitlab-com/gl-security/appsec
• The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team