UDAE: Backend changes for updated enrollment profile and endpoint

[JordanMontgomery]

Related user story

#40905

Task

Implement the backend changes to update Fleet's default Apple automatic enrollment profile and expose it over the REST API.

1. Merge in the contributor PR's changes to getDefaultProfile() in server/mdm/apple/apple_mdm.go from Update default Apple automatic enrollment profile #40832:
   • Remove IsSupervised: false
   • Remove Region: "US"
   • Remove Accessibility from SkipSetupItems
   • Add Intelligence, OSShowcase, SoftwareUpdate, UpdateCompleted, and Welcome to SkipSetupItems
   • Preserve attribution to the contributor (@spalmesano0) on the final commit if possible
2. Implement the new endpoint GET /api/v1/fleet/enrollment_profiles/automatic/default as documented in [API/YAML] API docs for v4.86.0 automatic enrollment profile update #43782:
   • Premium-only, authorization and middleware consistent with GET /api/v1/fleet/enrollment_profiles/automatic
   • No query parameters (the default profile is a singleton per Fleet instance)
   • Response shape: { "updated_at": <timestamp or null>, "enrollment_profile": { ... } }
   • When the mdm_apple_enrollment_profiles row exists, return the stored dep_profile JSON with the row's updated_at
   • When the row does not exist (fresh install), return the in-code getDefaultProfile() values with updated_at: null
3. Add unit and integration test coverage for the new endpoint (stored-row case, no-row case, auth/permission checks, premium gating).

Condition of satisfaction

• Changes file created for feature
  • Contributor PR Update default Apple automatic enrollment profile #40832 changes are merged in and attributed; getDefaultProfile() reflects the new defaults.
  • GET /api/v1/fleet/enrollment_profiles/automatic/default returns a 200 with the shape defined in PR [API/YAML] API docs for v4.86.0 automatic enrollment profile update #43782 in both the stored-row and no-row cases.
  • Endpoint is Premium-gated and rejects unauthenticated / insufficiently-privileged requests consistently with the sibling custom-profile endpoints(meaning anyone who can fetch a custom-profile for any team should be able to fetch the default).
  • Integration tests cover both response cases (stored row, no row) and auth/permissions.
  • No change to existing DB rows on upgrade