feat(rate_limit): add :skip rule action

What does this MR do?

Adds a :skip rule action to Labkit::RateLimit: a matched :skip rule terminates evaluation and allows without any Redis operation. The match stays observable via calls_total{action="skip"}.

Semantics next to the existing actions:

Rule action	Counts (Redis)	Terminates	Result action
:block	yes	on exceeded	:block / :allow
:log	yes	never	:allow (:log when exceeded)
:allow	yes	on match	:allow
:skip	no	on match	:allow

A :skip result carries matched: true, its rule, and no info (there is no counter), so to_response_headers is {}. peek treats :skip the same way: terminate on match, no Redis read. limit/period/characteristics/count_distinct are inert on :skip rules.

This is the backward-compatible slice of gitlab-com/gl-infra/production-engineering#29052 (closed) (:limit/:log/:skip model): :skip is added, :block/:allow/:log are unchanged. The :block to :limit rename and the metrics split remain in the issue.

Why

The GitLab stage 2b rack shadow (gitlab-com/gl-infra/production-engineering#28852) runs this engine at a sampled percentage against the shared redis-cluster-ratelimiting cluster, whose primaries are already near single-thread saturation. At 10% shadow, roughly 55% of the shadow's Redis writes come from terminating bypass rules (bypass_header, skip_internal_api, runner_jobs, dry-run bypasses) that use :allow purely because it is the only terminating action, paying an INCR per request for a counter nobody reads. Switching those rules to :skip removes those writes and is the main lever to make a 100% shadow (required for valid divergence measurement) fit in the cluster's capacity budget.

Notes

• Consumer switch happens in gitlab-org/gitlab (lib/gitlab/rack_attack/labkit_rate_limit/limiters.rb already marks its :allow bypass rules as :skip-pending) after a release containing this change.
• The cross-language conformance vectors (labkit-spec) do not cover action semantics yet; :skip needs vectors there once that harness lands.