Confirm API design

The frontend and backend DRIs should work together to ensure the API design will work for everyone.

For reference, a request to the current securityAttributeProjectUpdate API looks like this:

mutation addAttrs {
  securityAttributeProjectUpdate(input:{
    projectId: "gid://gitlab/Project/32",
    addAttributeIds: [
      "gid://gitlab/Security::Attribute/business_critical",
      "gid://gitlab/Security::Attribute/30"
    ],
    removeAttributeIds: [
      "gid://gitlab/Security::Attribute/42",
      "gid://gitlab/Security::Attribute/67"
    ]
  }){
    addedCount
    removedCount
    errors
  }
}