Antibot third-party checkbox hidden when global protection is ON

Problem/Motivation

When the global "Protect all webforms with Antibot" option is enabled, Webform determines whether global protection is active by checking the Antibot configuration.

Currently, the integration assumes a specific wildcard pattern (webform_submission_webform_*) to detect global protection. However, an equivalent wildcard such as webform_submission_* also correctly protects every Webform submission form, but is not recognized consistently by the integration.

As a result, the UI behaves incorrectly. When _webform_antibot_enabled() returns TRUE, _webform_antibot_form() returns early and the "Protect all webforms with Antibot" checkbox disappears from the global configuration page at /admin/structure/webform/config, preventing administrators from disabling global protection from the UI.

This issue became visible after the fix in companion Antibot issue #3613411, which synchronizes the global wildcard into antibot.settings. Before that fix, the wildcard was never synchronized, so this code path was never executed. The underlying issue, however, is that the Webform integration relies on a specific wildcard and hides the UI instead of handling global protection gracefully.

Steps to reproduce

1. Enable the Antibot and Webform modules.
2. Apply the fix from Antibot issue #3613411.
3. Go to /admin/structure/webform/config and enable "Protect all webforms with Antibot".
4. Save the configuration.
5. Return to /admin/structure/webform/config.
6. The "Protect all webforms with Antibot" checkbox is no longer displayed.

Proposed resolution

Do not hide the global Antibot checkbox when global protection is enabled.

Instead, always render the checkbox and adapt its behavior depending on the context:

1. Global admin form (WEBFORM_ANTIBOT_NEUTRAL): always display the checkbox as editable so administrators can enable or disable global protection.
2. Individual Webform settings when global protection is enabled: display the checkbox as checked and disabled, with a description explaining that protection is managed globally.
3. When global protection is disabled: preserve the current behavior for per-Webform configuration.

This issue is related to companion Antibot issue #3613411, but fixes an independent UI problem in the Webform integration that becomes visible once global Antibot synchronization works correctly.

Remaining tasks

• Review and feedback from maintainers.

User interface changes

When global Antibot protection is enabled, the "Protect all webforms with Antibot" checkbox remains visible on the global configuration page and can be used to disable global protection. On individual Webform settings pages, the checkbox is shown as enabled but disabled for editing while global protection is active.

API changes

None.

Data model changes

None.