Feature: Create pipeline_api token scope

Proposal

A US Government customer is proposing creating a more limited scope for api tokens. Their ideal approach is to create a instance-wide CI/CD variable, assign a personal access token, in order to utilize it across the instance to stop pipelines/jobs from executing. At present, they must choose api scope in order to stop any execution of jobs/pipelines. This present a large security issue as issuing an instance-wide api scoped PAT would allow any user to make any change to GitLab.

I believe a good middle-ground for this would be to create a pipeline_api scope, that would scope PATs to only pipeline interactions.

Relevant info:

Edited by David Coy