API for create new build variables is broken

Summary

The API for build variables is broken since 9.3 because the new protected field isn't optional. The documentation (https://docs.gitlab.com/ce/api/build_variables.html) says it is a not required field. This is breaking existing API wrapper like go-gitlab.

Steps to reproduce

This is failing:

curl --request POST --header "PRIVATE-TOKEN: abcdefghijkllmn" "https://gitlab.example.com/api/v4/projects/1/variables" --form "key=NEW_VARIABLE" --form "value=new value" 

This is working:

curl --request POST --header "PRIVATE-TOKEN: abcdefghijkllmn" "https://gitlab.example.com/api/v4/projects/1/variables" --form "key=NEW_VARIABLE" --form "value=new value" --form "protected=false" 

What is the current bug behavior?

Request fails with {"message":"500 Internal Server Error"}

What is the expected correct behavior?

Response should be {"key":"NEW_VARIABLE","value":"new value","protected":false}

Relevant logs and/or screenshots

Exception:

ActiveRecord::StatementInvalid: PG::NotNullViolation: ERROR:  null value in column "protected" violates not-null constraint
DETAIL:  Failing row contains (288, NEW_VARIABLE, null, aiwIJd3cogiurkONiSQDGw==
, _5+4DUL3WUrZsoA0ng9pZww==
, TQ00JSkd2v+BdxfAvM4gFg==
, 464, null).
: INSERT INTO "ci_variables" ("key", "protected", "encrypted_value_salt", "value", "encrypted_value_iv", "encrypted_value", "project_id") VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING "id"

Output of checks

(If you are reporting a bug on GitLab.com, write: This bug happens on GitLab.com)

Results of GitLab environment info

GitLab 9.3.0 CE

Possible fixes

Somewhere here: https://gitlab.com/gitlab-org/gitlab-ce/blob/950db1bd6472813bb539b69a309402c4eb115122/app/controllers/projects/variables_controller.rb#L46