feat(merge_requests): support blocking MR IID in dependency options

Closes #2308

Since GitLab 18.9, you can create a merge request dependency from the blocking merge request's IID (the !123 number), not only from its global ID. The blocking merge request can also be in another project. client-go only had BlockingMergeRequestID, so Go users had to look up the global ID first.

CreateMergeRequestDependencyOptions now also has BlockingMergeRequestIID and BlockingProjectID. Code that uses BlockingMergeRequestID sends the same request as before.

1. BlockingProjectID takes a numeric project ID or a full path like "group/project", because the endpoint accepts both.
2. The path has to be passed as is, not URL-encoded. It goes in the request body, and GitLab only looks a project up by path when the value contains a /. The field comment says this.

How I tested

I wrote a small Go program that calls CreateMergeRequestDependency with an IID and a project path against a local test server. The server prints the request it gets.

On main, the program doesn't compile, because the options don't exist:

unknown field BlockingMergeRequestIID in struct literal of type gitlab.CreateMergeRequestDependencyOptions
unknown field BlockingProjectID in struct literal of type gitlab.CreateMergeRequestDependencyOptions

On this branch, both fields go out in the body:

POST /api/v4/projects/my-group%2Fapp/merge_requests/12/blocks
body: {"blocking_merge_request_iid":5,"blocking_project_id":"other-group/lib"}
err: <nil>

The unit test now checks the request body for four cases: the global ID, an IID in the same project, and an IID in another project by ID and by path.

$ go test -count=1 -run 'TestCreateMergeRequestDependency' -v .
...
ok  	gitlab.com/gitlab-org/api/client-go/v3	0.004s

gofumpt -l and go vet . printed nothing. golangci-lint, make generate and the -race tests run in the pipeline.

I couldn't test against a real GitLab server. The endpoint is Premium only, and I don't have an instance with it.

The server requires exactly one of BlockingMergeRequestID and BlockingMergeRequestIID and returns 400 otherwise. The field comment says this, like other options in the library with the same rule.

Implemented with AI assistance; I reviewed and tested the changes.