fix(policy): reject unknown endpoint security modes

[2000krysztof]

Summary

WIP Until Monday

Validate TLS, enforcement, and access values across policy and provider profile ingress, and prevent runtime parsing from falling back to audit for unknown enforcement values.

Related Issue

Closes #3046

Changes

• Added shared validation for endpoint tls, enforcement, and access strings.
• Rejects unknown values with actionable errors listing accepted values.
• Applies validation to sandbox policies and provider profiles.
• Prevents malformed enforcement values such as enforc from falling back to audit mode.
• Added defensive runtime rejection for invalid endpoint modes.
• Returns gRPC INVALID_ARGUMENT before invalid policies are persisted or activated.
• Added regression tests for policy, provider-profile, gateway, and runtime validation.
• Documented the accepted values and fail-closed behavior.
• No protobuf or generated SDK types changed yet. Secound commit will be made to address that (WIP)

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.