Authorize 25 Organizations GraphQL types for fine-grained tokens

Summary

A fine-grained personal access token is denied the Organizations GraphQL types below: they declare no authorize_granular_token directive and are still listed in config/authz/graphql/authorization_todo.txt, so the fields that return them give the token null, an empty list or an error. A legacy token can use them.

As discussed in !267273 (comment 4195231927), I will send this domain's remaining types in one merge request, which closes this issue.

Already merged

• !267275 (merged): DetailedImportStatus, FileUpload, ProjectFeatureAccess.
• !268628 (merged): GroupNamespaceMarkdownPaths, ProjectNamespaceMarkdownPaths, UserNamespaceMarkdownPaths.

ProjectNamespaceMetadata, UserNamespaceMetadata and UserNamespaceLinks stay on the list: since !266839 (merged), gitlab:permissions:validate wants every type of the NamespaceMetadata and NamespacesLinkPaths interfaces to declare the same permission, and both interfaces also have types that stay on the list.

Proposal

• Returned only through a parent that already checks the token, so each relies on that check (parent_authorizes), with a spec for each parent: Ide, NamespaceCommitEmail, RecentlyViewedItem, UserCallout, UserDuoStatus, UserGroupCallout.
• authorize_granular_token with an existing permission: CustomAttribute, PendingGroupMember, PendingProjectMember, UserStatus.
• Already relying on their parent, but listed as parent_authorizes: entries because they name no permission; each names the one its parents already check: Achievement, GroupMemberPermissions, GroupPermissions, NamespacePermissions, NamespaceProjectStatistics, OrganizationUserPermissions, ProjectStatistics, ProjectStatisticsRedirect, UserPermissions.

I expect no new permission.

Related to #593878.

I found this while working on gitlab-mcp-server.