Bump the Duo CLI version Rails pins for CI-run flows so they can read images

Problem

Flows started from the GitLab UI, a mention of @duo-developer in a discussion or Implement on an issue, run in a CI job. Rails writes the job script, and the script downloads the Duo CLI binary at DUO_CLI_VERSION in ee/app/services/ai/duo_workflows/start_workflow_service.rb. That binary is the flow executor: it is what reads files for the model.

The pin is 9.25.0. Duo CLI 9.27.0 (1 Oct, gitlab-lsp!4244) is the first release whose executor returns images from read_file. So in a CI job, read_file on a PNG still answers "binary file", and the model never sees screenshots or issue attachments in those two flows. The same flow in the Duo CLI or an IDE already does, because users update those clients themselves.

The feature flag is not a second blocker: the job's token is issued to the human who triggered the flow, and Rails evaluates dap_tool_image_input for that human.

Fix

Bump DUO_CLI_VERSION to 9.27.0 or later. One constant; CI reads it from the same file to install and verify the binary. Both binaries for 9.27.0 are in the package registry.

MR: gitlab-org/gitlab!260311 (merged)

Why it matters for the docs

The Developer Flow page leads with these two scenarios. Without the bump, the image input docs (#3061) would have to say the feature works in the CLI and the IDEs but not from a mention or an issue.