feat: require the code of conduct for oauth apps

[jaspermayone]

Summary

Every OAuth app now requires the code of conduct. A superadmin can opt out one app, one user, or both.

Changes

• New column oauth_applications.requires_code_of_conduct (default true): opts out one app.
• New column users.code_of_conduct_exempt (default false): opts out one user. Exempt users are also left out of User.code_of_conduct_pending, so nobody asks them to accept.
• AppAccess.explain refuses a user without slack_coc_accepted_at when the app requires the code of conduct. Every endpoint asks AppAccess, so this covers authorize, token exchange, refresh, introspection, userinfo and the directory.
• An opted-out app, or an exempt user, still goes through the access policy of the app.
• On GET /oauth/authorize, a user who only lacks the acceptance goes to /slack. After they accept, they go back to the authorize URL.
• The access-denied page links to /slack when the reason is the code of conduct.
• The admin user page shows the user's acceptance and has an "Exempt from the Code of Conduct" / "Remove the exemption" button (superadmin only). Removing the exemption enqueues RevokeLostAppAccessJob for the user.
• The admin app page has an "Opt out of the Code of Conduct" / "Require the Code of Conduct" button (superadmin only). The app list shows a "CoC optional" badge. Turning the requirement back on enqueues RevokeLostAppAccessJob.
• New factory trait :accepted_code_of_conduct for OAuth specs.

sequenceDiagram
  participant U as User
  participant W as Weave
  U->>W: GET /oauth/authorize
  W-->>U: 302 /slack (app requires CoC, no acceptance)
  U->>W: POST /slack/code-of-conduct
  W-->>U: 302 back to /oauth/authorize

Loading

Rollout

The requirement starts when this deploys. Users who have not accepted lose app access at once, and their existing tokens stop working. Opt out the apps or users that must keep working before you deploy, or right after.

Test plan

• bundle exec rspec
• bin/rubocop

This PR has a migration.