Authorize 28 Deploy GraphQL types and a mutation for fine-grained tokens

Summary

A fine-grained personal access token is denied the Deploy GraphQL types below: they declare no authorize_granular_token directive and are still listed in config/authz/graphql/authorization_todo.txt, so the fields that return them give the token null or an empty list, even when it can read the release, the deployment, the environment or the cluster agent. ClusterAgentTokenRevoke is listed too, so the token cannot revoke an agent token even with revoke_cluster_agent_token. A legacy token can use them.

As agreed in !267273 (comment 4195231927), I will send this domain's types and mutation in one merge request, which closes this issue.

Proposal

• authorize_granular_token with the existing permission that their REST endpoints use: Release (read_release), Deployment (read_deployment), ProtectedEnvironment (read_protected_environment, on its project or group), FeatureFlag (read_feature_flag), GroupReleaseStats (read_release on the group), ClusterAgentUrlConfiguration (read_cluster_agent_url_configuration) and ClusterAgentToken (read_cluster_agent_token), and revoke_cluster_agent_token on the project of the token for ClusterAgentTokenRevoke.
• read_protected_environment on the project or group of their protected environment for ProtectedEnvironmentDeployAccessLevel, ProtectedEnvironmentApprovalRule and ProtectedEnvironmentApprovalRuleForSummary, and read_deployment on its project for DeploymentApproval (also the payload of the approval mutation, which returns it only to a token that can read deployments).
• The same check on the fields that return the releases of a project or group (read_release), a project's nested environments (read_environment), its agent configurations and its authorized agents (read_cluster_agent), the abilities they already check for the user.
• Returned only below a release, a cluster agent, a deployment or one of those fields, so each declares the permission its parent checks (parent_authorizes:), with a spec for each parent: ReleaseAssets, ReleaseLinks, ReleaseEvidence, ReleaseSource, ReleaseAssetLink (also the payload of the release link mutations, which check the token themselves), ConnectedAgent, AgentMetadata, AgentWarning, AgentVersionWarning, ClusterAgentActivityEvent, AgentConfiguration, ClusterAgentAuthorizationCiAccess, ClusterAgentAuthorizationUserAccess, NestedEnvironment, DeploymentTag, DeploymentApprovalSummary and DeploymentPermissions.

I expect no new permission.

Related to #593878.

I found this while working on gitlab-mcp-server.