Introduce `blocked_pending_approval` user state

What does this MR do?

For #257878 (closed)

This MR introduces a new state for user named blocked_pending_approval. This is supposed to be the starting state of a user

• who registers via the registration form AND
• the toggle introduced in !43827 (merged) is turned on.

This MR introduces only

• the new state.
• its behaviour (ie, across the app, these users behave the same as a normal blocked user)
• specs checking its permissions.

This MR does not introduce any way for a user to register in this state, or for an admin to convert a user to this state via the API or the UI and hence, there are no user-facing changes here (and hence no changelog). These will be added in a subsequent MR.

Note: Even though these users behave like a normal blocked user, at some places (like in error messages, flash notices etc), it is necessary to be explicit about "your account is blocked pending approval" rather than the usual "your account is blocked" message. Hence in these places, we do a user.blocked_pending_approval? check before the user.blocked? check.

Screenshots

When a user blocked_pending_approval tries to login. (Since there is no way currently to turn a user into this state via the UI/API, I took this screenshot after changing the state of an existing user to blocked_pending_approval via Rails console.)

A user blocked_pending_approval also appears in the "Blocked" tab under /admin/users page. I will make further required modifications in this page in a new MR.

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers
• Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• Label as security and @ mention @gitlab-com/gl-security/appsec
• The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team