Explicitly document all operations/systems `CI_JOB_TOKEN` can and cannot be used for

Problem to solve

• What product or feature(s) affected?
  • API
  • CI/CD
  • Security
• What docs or doc section affected? Include links or paths.
  • https://docs.gitlab.com/ee/user/project/new_ci_build_permissions_model.html
  • Many other doc pages that independently reference CI_JOB_TOKEN usage
• Is there a problem with a specific document, or a feature/process that's not addressed sufficiently in docs?
  • There is no unified doc that lists out all places where CI_JOB_TOKEN can and cannot be used for authentication.
  • Moreover, existing documentation tends to imply CI_JOB_TOKEN can be used as a universal replacement for virtually any kind of request to various parts of the system, but this is not actually the case.

Further details

• API endpoints inconsistently accept a CI_JOB_TOKEN
  • Downloading CI artifacts work
  • Creating MRs appears to require a PERSONAL_ACCESS_TOKEN
• Container registry works
• Package registry works
• git clone/pull operations work
• git push operations do not work?
• ...?

Proposal

I think CI_JOB_TOKEN should in fact be a valid auth mechanism in all cases, but the first step to achieving that will be compiling and understanding current limitations.

tl;dr: there should be a table on the "New CI job permissions model" page that lists:

System	CI_JOB_TOKEN	PERSONAL_ACCESS_TOKEN
Artifact API	✅	✅
Example	❌	✅
Example	✅	❌