Add governance policy block lists and policy actions

[Bionic711]

Summary

Adds administrator-friendly governance block lists and delegated policy actions for feature, MCP, model endpoint, and action governance scenarios.

• Adds denied users/groups to governance policy models, persistence, normalization, enforcement, and activity logging.
• Ensures deny/block lists override allow-all and explicit allow-list grants.
• Supports intentional delegated item policy retargeting without duplicating stale policy documents.
• Adds admin UI actions for Show Users, Duplicate, and Inverse delegated item policies.
• Updates MCP governance wiring, help text, functional/UI coverage, feature documentation, release notes, and app version.

Validation

• git diff --check
• node --check application\single_app\static\js\admin\admin_governance.js
• python -m py_compile on changed Python files
• .\.venv\Scripts\python.exe -m py_compile on changed Python files
• python scripts\check_swagger_routes.py application\single_app\route_backend_governance.py
• python functional_tests\route_tests\test_route_blueprint_policy_inventory.py
• python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py
• python functional_tests\route_tests\test_route_policy_test_coverage.py
• .\.venv\Scripts\python.exe functional_tests\test_governance_activity_logging.py
• .\.venv\Scripts\python.exe functional_tests\test_governance_enforcement_logic.py
• .\.venv\Scripts\python.exe functional_tests\test_governance_route_and_wiring_coverage.py
• .\.venv\Scripts\python.exe functional_tests\test_inbound_mcp_governance_and_tools.py
• .\.venv\Scripts\python.exe functional_tests\test_mcp_destination_governance_and_preconfigurations.py
• python scripts\check_broken_access_control.py --base-sha origin/Development --head-sha HEAD ...
• python scripts\check_xss_sinks.py --base-sha origin/Development --head-sha HEAD ...

UI note: python -m pytest ui_tests\test_admin_governance_tab.py -q and the venv equivalent were invoked locally and skipped because the local UI auth/environment state is not configured.

Release notes: added under v0.250.208.

Related Issue

Fixes #1252