[BE] Add the CBE competency models to the PII annotation safe list

Background

openedx-core is adding the Competency-Based Education (CBE) data models under its openedx_learning
app. openedx/openedx-core#641 adds the criteria definition models, openedx/openedx-core#642 adds the
mastery status lookup and the learner progress models, and openedx/openedx-core#613 is the parent
issue covering both.

This repo runs a PII annotation check that requires every active Django model to be labelled as
containing personal data or not. That check only scans this repo's own tree: .pii_annotations.yml
sets source_path: ./, so it never reads models inside installed site-packages. Every openedx-core
model is therefore listed by hand in this repo's .annotation_safe_list.yml, even where the
annotation is already written in openedx-core's own source. openedx/openedx-platform#38958 added the
first entry for this app, openedx_learning.CompetencyTaxonomy, for exactly that reason, and the
same file already carries dozens of entries for openedx_content and openedx_catalog models.

openedx_learning is already in INSTALLED_APPS for both LMS and CMS. So the moment the
openedx-core pin moves to a version containing #641 and #642, ten new models become active with no
safelist entry here, and make pii_check drops below its 100% coverage target.

What to do

Add ten entries to .annotation_safe_list.yml, each annotated as containing no PII, in the same
shape as the existing openedx_learning.CompetencyTaxonomy entry:

openedx_learning.CompetencyCriteriaGroup:
  ".. no_pii:": "No PII"

The ten models, by the openedx-core issue that creates them:

From openedx/openedx-core#641, the criteria definition models:

• openedx_learning.CompetencyCriteriaGroup
• openedx_learning.CompetencyRuleProfile
• openedx_learning.CompetencyCriterion
• openedx_learning.HistoricalCompetencyCriteriaGroup
• openedx_learning.HistoricalCompetencyRuleProfile
• openedx_learning.HistoricalCompetencyCriterion

From openedx/openedx-core#642, the mastery status lookup and learner progress models:

• openedx_learning.CompetencyMasteryStatuses
• openedx_learning.StudentCompetencyCriteriaStatus
• openedx_learning.StudentCompetencyCriteriaGroupStatus
• openedx_learning.StudentCompetencyStatus

The three Historical* models are generated by django-simple-history, which openedx-core applies
to its criteria definition models. They are real Django models and the annotation scan counts them.
This repo's safelist already carries Historical* entries for many other apps, so they are routine
rather than a special case.

None of the ten stores personal data of its own. The three StudentCompetency*Status models hold a
user foreign key and a status value, which is how every existing openedx-core model with a user
foreign key is annotated here, openedx_content.PublishableEntity and openedx_content.Collection
among them. pii_retirement: consumer_api is not used, because it asserts a consumer-facing
retirement API that openedx-core does not have.

Ordering constraint

This has to land in the same pull request as the openedx-core pin bump that brings in #641 and
#642. Bumping the pin without these entries breaks pii_check; adding the entries without the pin
bump names models that do not exist yet.

Acceptance criteria

• All ten entries above are present in .annotation_safe_list.yml
• make pii_check passes at 100% coverage
• The openedx-core pin in requirements/edx/kernel.in and requirements/edx/base.txt
  resolves to a version containing openedx/openedx-core#641 and openedx/openedx-core#642
• make check_migrations passes and the new migrations apply cleanly

Out of scope

Any INSTALLED_APPS or import-linter change. openedx/openedx-platform#38958 already registered
openedx_learning and added it to the isolated_apps contract, and both of those cover the whole
app rather than being per-model.

Blocked by

openedx/openedx-core#641 and openedx/openedx-core#642 must merge and be released first.