Remove the waffle-flag-states endpoint in Willow

Description

Remove GET /api/authz/v1/waffle-flag-states/ during the Willow release.

The endpoint was added in #358 as a bridge for the Verawood release. It exposes the raw state of authz.enable_course_authoring so the Admin Console can apply the visibility rule from #340 and #341 on the client.

ADR 0018 defines the longer-term path: authorization endpoints call a domain-neutral Open edX Filter, while a separate course-authoring pipeline step applies flag-specific visibility. Once the Admin Console uses those backend-filtered results, it no longer needs the raw flag-state endpoint.

This work does not depend on removing authz.enable_course_authoring. The flag may remain for later releases. Its eventual removal is tracked separately in openedx/openedx-platform#37927.

Per ADR 0016, WaffleFlagStatesAPIView is a temporary exception to Authorization's domain boundary. Removing it in Willow closes that exception without making flag removal part of this issue.

Definition of Done

• The backend filtering described in ADR 0018 is available and configured where the Admin Console needs it
• The Admin Console no longer uses GET /api/authz/v1/waffle-flag-states/ or its client-side flag-state resolution
• WaffleFlagStatesAPIView, its URL, openedx_authz.utils.get_waffle_flag_states(), and their tests are removed from openedx-authz
• ADR 0015 is updated to record the endpoint's removal
• Removal of authz.enable_course_authoring remains tracked separately in openedx/openedx-platform#37927

References

• #358 (introduced the endpoint)
• #340 and #341 (the Admin Console visibility rules)
• ADR 0015: docs/decisions/0015-expose-course-authoring-waffle-flag-state-via-rest-api.rst
• ADR 0016: docs/decisions/0016-rest-api-domain-ownership-boundary.rst
• ADR 0018: docs/decisions/0018-cross-domain-filtering-via-openedx-filters.rst
• openedx/openedx-platform#37927 (upstream flag removal tracking)

Start by tracing WaffleFlagStatesAPIView, its URL, openedx_authz.utils.get_waffle_flag_states(), and their tests. Read ADRs 0015, 0016, and 0018, and verify the Admin Console uses the backend-filtered results instead. Done means the endpoint and client-side flag-state resolution are removed, ADR 0015 records the removal, and the separate flag-removal work remains untouched.