Authorize 17 Pipeline Authoring GraphQL types for fine-grained tokens

Summary

A fine-grained personal access token is denied the Pipeline Authoring GraphQL types below: they declare no authorize_granular_token directive and are still listed in config/authz/graphql/authorization_todo.txt, so the fields that return them give the token null, an empty list or an error. A legacy token can use them.

As agreed in !267273 (comment 4195231927), this domain's types go in one merge request, which closes this issue. Those already in an open merge request stay there.

Already in an open merge request

• !267264 (merged): CiCatalogResourceComponentUsage.

Proposal

• Returned by the CiLint mutation, which already checks the token with validate_ci_config, so each relies on that check (parent_authorizes: :validate_ci_config): CiConfigGroupV2, CiConfigInclude, CiConfigJobRestriction, CiConfigJobV2, CiConfigNeed, CiConfigStageV2, CiConfigV2.
• The deprecated CiConfig, CiConfigGroup, CiConfigJob and CiConfigStage subclass the V2 types and inherit their declaration, so the deprecated Query.ciConfig checks validate_ci_config too.
• With the existing read_variable permission: CiGroupEnvironmentScope, CiGroupVariable, CiProjectVariable and InheritedCiVariable through the fields that return them, on their project or group, and CiInstanceVariable on the instance.

This uses the existing validate_ci_config and read_variable permissions and adds none.

Related to #593878.

I found this while working on gitlab-mcp-server.