Add support for Compliance Pipelines in Security Policies

What does this MR do and why?

This adds an experimental feature that allows to specify a CI configuration as part of a scan execution policy.

The feature is behind the compliance_pipeline_in_policies feature flag.

📺 Demo: https://www.youtube.com/watch?v=6Km20io_EZ8

Note: The demo shows an outdated schema. The property should include scan: custom next to ci_configuration.

Related issue: Spike: Prepare PoC and document limitations for... (#420621 - closed)

How to set up and validate locally

1. Create a new project.
2. Add a simple CI file to the project:

   test1:
     stage: test
     script:
       - echo "This is a test"

3. Go to Secure -> Policies.
4. Select New Policy.
5. Select Scan execution policy.
6. Switch to **.yaml mode.
7. Enter a simple CI configuration as custom scan:

   type: scan_execution_policy
   name: 'test'
   description: ''
   enabled: true
   rules:
     - type: pipeline
       branch_type: all
   actions:
     - scan: custom
       ci_configuration: |-
         test2:
           stage: test
           script:
             - echo "This is a test included from security policy"

8. Select Configure with a merge request.
9. Merge the MR.
10. Run a pipeline, your project.
11. The pipeline should include two jobs. One from the project CI and one from the security policy CI.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.