Added controller method that returns not accepted policies by user

[dati18]

Summary

• Controller logic updated in PoliciesController.php with new endpoint getMissingPolicies
• API route added in routes/api.php (new authenticated route GET v1/policies/missing, handled by PoliciesController@getMissingPolicies)
• New test class covering both current and missing policies, including coverage for:
  • auth required on missing endpoint
  • only latest active policy per type is returned
  • future policies are excluded
  • already accepted policies are excluded for current user
  • another user’s acceptances do not affect current user
  • empty list when all current policies are accepted
  • current policies response structure and payload fragments
• The older PoliciesController test under tests/Http/Controllers was merged into the route-level file above because they do full http behaviors like auth middleware, URL, JSON request/response, calling endpoints, etc., not isolated controller functions

Bug: T432337

[rosalieper]

I think you have accidentally added unwanted changes to this PR. I see changes from #1207 here. ignore

stale request

[rosalieper]

I am happy with the change 💯

[tarrow]

I really like a lot of this patch.

The tests are super comprehensive and readable to me.

I liked that you identified that this should be in Routes test.

I'm still a bit sceptical about the query logic which I personally find hard a little harder to parse than the far less efficient first draft but I do agree that performance probably matters here so it's an acceptable tradeoff for me.

I've left a small suggestion for the direction I looked into just for your interest but I don't think we should look further into this.