Add API integration to fetch blocked versions at job construction

[kbukum1]

What are you trying to accomplish?

Add the API client integration that fetches blocked versions from the API and injects them into the job definition at construction time. Blocked versions are globally managed (not per-job configuration), so they need to be fetched fresh at execution time. This ensures the updater always uses the latest blocked versions list.

This PR also renames the blocked versions field from version to version-requirement to align with ignore_conditions conventions and the API endpoint contract.

Stacks on #14915 which adds the blocked_versions attribute to the Job class.

Anything you want to highlight for special attention from reviewers?

• The fetch is gated behind Experiments.enabled?(:dependabot_blocked_versions) — no behavior change without the flag.
• Experiments are pre-registered from the job definition (with hyphen-to-underscore normalization) before the gate, so the flag works when set via the job payload.
• The job definition is deep-copied (JSON.parse(JSON.generate(...))) to avoid mutating the memoized Environment.job_definition.
• On API failure (500, timeout, network error, invalid JSON, non-Hash/non-Array response), the updater continues without blocked versions (graceful degradation).
• version-requirement field name matches ignore_conditions conventions — the API endpoint transforms from the model's version field to version-requirement in the response.

How will you know you've accomplished your goal?

• api_client_spec.rb: 6 tests covering success, error, timeout, empty response, invalid JSON, non-object JSON, and non-array data.
• update_files_command_spec.rb: 3 tests covering fetch + inject, experiment flag via job definition, and empty response handling.
• job_spec.rb: All blocked versions test data updated to use version-requirement field name.
• Once the dependabot_blocked_versions experiment is enabled, blocked versions will appear in updater logs as "Blocked versions (by GitHub Security)" for matching dependencies.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

This PR wires a new updater-side integration to fetch globally managed “blocked versions” from dependabot-api at execution time (behind an experiment flag) and flow them into Dependabot::Job so they participate in the normal ignore/version filtering and logging paths.

Changes:

• Add ApiClient#fetch_blocked_versions(package_manager) and expose it via Dependabot::Service.
• Fetch blocked versions during UpdateFilesCommand#job construction when Experiments.enabled?(:blocked_versions) and inject them into the job definition before Job.new_update_job.
• Extend Dependabot::Job to carry blocked_versions, apply them as additional ignore requirements, and log matching blocked entries (plus add/extend specs).

Show a summary per file

File	Description
updater/lib/dependabot/api_client.rb	Adds a new API call to retrieve blocked versions for a job.
updater/lib/dependabot/service.rb	Delegates fetch_blocked_versions to the API client.
updater/lib/dependabot/update_files_command.rb	Fetches/injects blocked versions at job construction time behind an experiment flag.
updater/lib/dependabot/job.rb	Adds blocked_versions to job attributes; applies/logs blocked version ignores.
updater/spec/dependabot/api_client_spec.rb	Adds unit tests for fetch_blocked_versions behavior.
updater/spec/dependabot/update_files_command_spec.rb	Adds tests for the job-construction-time fetch behavior.
updater/spec/dependabot/job_spec.rb	Adds tests for blocked versions being enforced/logged via job ignore logic.

Copilot's findings

• Files reviewed: 7/7 changed files
• Comments generated: 3

[Copilot]

Copilot's findings

• Files reviewed: 5/5 changed files
• Comments generated: 2

[Copilot]

Copilot's findings

• Files reviewed: 5/5 changed files
• Comments generated: 2

[Copilot]

Copilot's findings

• Files reviewed: 7/7 changed files
• Comments generated: 1

[Copilot]

Copilot's findings

• Files reviewed: 7/8 changed files
• Comments generated: 1

[Copilot]

Copilot's findings

• Files reviewed: 7/8 changed files
• Comments generated: 0 new