Visual Compliance Check for E-Disty

## Summary

When an order is first submitted, received by Platypus and by Customers API, a callout to Visual Compliance must be made to validate that the End User information is on a denied parties list. [This document](https://docs.google.com/presentation/d/1hD1xgEyJL1U1eyvTci6NNlCdIur4PkB16GO52wjZRgk/edit#slide=id.g5d8fd53174_0_44) provides more information on how Visual Compliance works today for sales assisted deals.

If compliance check fails, Arrow needs to be notified of order rejection. If compliance check passes, the order should proceed and data should continue to flow through GitLab's internal systems.

## Requirement

Ensure all Arrowsphere Orders are submitted through Visual Compliance prior to booking.

## Potential Options

### Option 1: Use CDot Existing API

- A pre-requisite to this step will be to [enable VC in CustomersDot](https://gitlab.com/gitlab-org/customers-gitlab-com/-/issues/3393), date TBD.
- The `ComplianceCheckService` can likely be re-used for the new subscribe API endpoint to be used by Platypus.
  * Currently the `ComplianceCheckService` is utilized in a `before_action` filter for a few controller actions: customer registration and subscriptions controller actions (new, edit, renew, autorenew).
- The tricky part will be making sure the input from Arrow matches the expectation for the visual compliance API. It expects 3 parameters: `company`, `country`, `state`. It's difficult to say because we don't have access to docs, but I believe it uses [the ISO_3166 standard](https://en.wikipedia.org/wiki/ISO_3166-1#Current_codes).
- The other piece to sort out is what to do when compliance fails. The requirements say "Arrow needs to be notified of order rejection". Are there any more specifics known for this requirement? Is Arrow looking for a specific HTTP code? I'm not sure we need to know all the specifics at this point for estimation, as long as the expected response isn't too involved.


### Option 2: Create Platypus Callout
* The original decision for e-disty implementation was for Platypus to own the compliance check
* After meeting with Visual Compliance, API setup does seem straightforward & doable, however there will be an additional cost to proceeding this way

##### Pricing Info
* Annual price of approximately 12,000 USD given standard 3 year term and leveraging of existing Gitlab/Descartes Visual Compliance master terms
* One-time $2,500 integration service and activation setup fee for the initial implementation effort which covers a dedicated implementation consultant, sandbox/test environment, and concierge service to ensure solution is up and running as efficiently as possible

## Proposal

As of June 2 2022, we are leaning towards implementing Option 1, with some alterations.  The original plan for Option 1 was to first enable existing VC solution (as part of https://gitlab.com/gitlab-org/customers-gitlab-com/-/issues/3393).  The existing VC solution was disabled in production because of a discrepancy between the countries that VC was blocking and the countries that GitLab wanted to block.  However, with v1 of the Distributor e-Marketplace solution with Arrowsphere, we only need to account for US-based orders, making the existing VC API a possibility at least in the short-term.

The current proposal is to implement and enable VC just for the marketplace API as a short-term solution to be able to release v1.  Long-term, the VC solution in CDot will be replaced with RiskRate.

Story points: 3.0