Refactor CAPTCHA internals

What does this MR do and why?

Refactor CAPTCHA internals. These are preliminary refactors/cleanup in preparation for adding CAPTCHA support to the REST API in #352913 (closed) and !80793 (merged)

Details:

• Add explicit named parameters for spammable to have a more functional and easier-to-understand interface
• Update and improve comments
• Ensure Spammable#spam is always a boolean and not nil
• Simplify Mutations::SpamProtection

How to set up and validate locally

See Testing Notes Section on the CAPTCHA epic for details on how to test CAPTCHA locally.

I (@cwoolley-gitlab) have exploratory tested that CAPTCHA still works for the following:

1. Snippet create/update with CAPTCHA
2. Snippet update with forced DISALLOW verdict
3. Issue create/udpate
4. Issue create/udpate with forced DISALLOW verdict

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Relates: #352913 (closed)