Add Developer default role with create + read secrets metadata for projects

Why are we doing this work

Iteration 2 of &22561. Extends the default-role grants one step below Maintainer, so Developers can create secrets for their own projects without needing an Owner.

This is a stretch item. Split out from the Maintainer work (#623437 (closed)) deliberately so it can be dropped without affecting it.

Scope

Per the epic: "Developers can create secrets and read secrets metadata at the project level by default."

Note the deliberate difference from Maintainer (#623437 (closed)), which also gets update. Developers get create without update — they can add new secrets but not modify existing ones.

read_value is explicitly out of scope, for the same reasons noted in #623437 (closed).

Blocked by

#623435 (closed) — create-without-update is not expressible today, because the write action fans out to both the create and update OpenBao capabilities. This is precisely why Developer was deferred in #621682 (closed) while Maintainer was not:

Can we add a new "Create" permission in 19.4? Answer: ... In the meantime we will only add the Maintainer default permission.

The epic (SSoT) still lists Developer under Iteration 2, so the deferral is a sequencing consequence rather than a descope. Once #623435 (closed) lands, this should be a small increment on top of whatever grant mechanism ships for Maintainer.

Acceptance criteria

  • Developers can create secrets and read secrets metadata at the project level by default
  • Developers cannot update existing secrets
  • Owners can remove Developer from the Secrets Manager permission access list
  • Removing the role immediately revokes that role's granted ability
  • No privilege escalation: Developers cannot delete secrets unless otherwise granted
  • read_value is not granted
  • doc/user/permissions.md updated for the project Secrets Manager table

Notes

Worth confirming with Product Management that Developer-level secret creation is desired at GA, since Developer is the widest role that would gain write access to a secrets store.

Edited by 🤖 GitLab Bot 🤖