[DAP][Approvals] Report approval source when resolving tool call approvals

Problem to solve

When DWS resolves a tool call approval (via exact hash match, glob pattern match, or preapproved tool list), it does not report back to Rails why the approval was granted. The ToolApprovalRequestNode checks stored approvals and either skips or requests approval, but the resolution reason is not propagated to the audit trail.

Proposal

Add approval source tracking to the DWS tool approval flow:

• When ToolApprovalRequestNode resolves an approval via _should_skip_approval(), record the reason (e.g., preapproved_tool, exact_hash_match, pattern_match)
• When approval is resolved via Rails GraphQL query (toolCallApproved), capture the match type returned by Rails
• Extend the protobuf Approval.Approved message to include an optional approval_source field
• Pass the approval source through to Rails so it can be included in audit events

Further details

• For preapproved tools (privilege-level), the source is PREAPPROVED_TOOL — these are checked locally and never hit Rails
• For per-call approvals delegated to Rails, Rails should return the match type (exact vs. pattern) and DWS should forward it
• Related MR discussion: gitlab-org/editor-extensions/gitlab-lsp!3514 (comment 3463856046)