feat: Add Duo settings to gitlab_group resource

What does this MR do?

The gitlab_group resource can now manage GitLab Duo for a group with two new attributes: duo_features_enabled and lock_duo_features_enabled. Before, these had to be changed in the UI or with the API, outside Terraform.

These settings need Premium or Ultimate with GitLab Duo. GitLab only returns the two booleans when AI features are available for the group and the user is an Owner or an admin.

Some decisions, by their effect on users:

1. There is no duo_availability attribute. GitLab accepts it, but it is only a write shortcut for the two booleans, and the Groups API never returns it. The UI options map to the booleans like this:

   UI option	duo_features_enabled	lock_duo_features_enabled
   Always on	true	true
   On by default	true	false
   Off by default	false	false
   Never on	false	true

2. Both settings are sent right after the group is created, not in the create request. The client library has no create fields for them.

3. I left out experiment_features_enabled. GitLab doesn't return the group's own value for it. On self-managed it returns the instance setting, and on GitLab.com the top-level group's value. So it would drift.

For a subgroup, GitLab also respects a lock on a parent group, but the API only returns the subgroup's own flag. So Terraform can show a different value than the UI there.

Related issues

Closes #6901

How I tested

I added acceptance tests that set both booleans, read them back, and check the "Never on" case from the issue. They need EE, so the CE acceptance jobs skip them. The existing gitlab_group tests run in the pipeline against GitLab CE 19.2, 19.3 and 19.4.

Locally I ran the unit tests of the changed package:

$ go test -count=1 ./internal/provider/sdk/
ok  	gitlab.com/gitlab-org/terraform-provider-gitlab/internal/provider/sdk	37.044s

gofmt, terraform fmt -check on the example, and go vet (with and without the acceptance tag) printed nothing. I regenerated the docs with tfplugindocs. The rest runs in the pipeline.

I have two questions:

1. Since I left out experiment_features_enabled, should this MR still close the issue? Or should I open a follow-up issue for it?
2. The EE acceptance tests only run when ENABLE_EE_ACCEPTANCE_TESTS is set. Can you trigger them for this MR?

Implemented with AI assistance; I reviewed and tested the changes.