Allow enabling policy enforcement at the workflow contract level #3762

Today policy enforcement (control gates) can be configured in two places:

• The organization default (chainloop org update --block), which applies to all contracts in the organization.
• Each policy or policy group attachment in a contract, with the gate field.

There is no way to enforce all the policies of one contract without setting gate: true on each attachment, or enforcing the whole organization.

This issue proposes a contract-level setting (spec.policies.gate) that enforces all the policies of a contract. Enforcement should only tighten: a lower level (contract, group, or policy attachment) can turn enforcement on, but cannot turn off enforcement that a higher level set. This changes the current documented behavior, where gate: false on an attachment opts out of organization-wide enforcement.

A design spec will follow in docs/specs/.