Add relation between security policies and compliance requirements

What does this MR do and why?

1. Add relation between compliance framework security policies and compliance requirements.
2. Compliance framework security policies can have many compliance requirements.
3. Compliance requirements can also have many compliance framework security policies.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before	After

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

1. Create a new compliance framework. Follow this doc for details.
2. Create a security policy scoped to the above framework. Check docs for details.
3. Since we don't have UI or GraphQL APIs for creating requirements we need to use Rails console for doing this.

framework = ComplianceManagement::Framework.last

framework.compliance_requirements.create!({namespace_id: framework.namespace_id, name: "Merge Request Controls", description: "Requirement to check that merge request controls are in place"})

requirement = framework.compliance_requirements.first

requirement.compliance_checks.create({compliance_requirement: requirement, namespace_id: framework.namespace.id, check_name: :at_least_two_approvals})

policy = ComplianceManagement::ComplianceFramework::SecurityPolicy.last

requirement.security_policy_requirements.create!({compliance_framework_security_policy_id: policy.id, compliance_requirement_id: requirement.id, namespace_id: framework.id})

requirement.reload.compliance_framework_security_policies # this should list the policy we linked above.

policy.reload.compliance_requirements # the reverse should also work i.e. the linked policy should list the linked compliance requirement.

Related to #477916 (closed)