Authorize 2 GitLab Duo settings GraphQL types for fine-grained tokens

Summary

A fine-grained personal access token is denied two GraphQL types of the GitLab Duo administrator settings: they declare no authorize_granular_token directive and are still listed in config/authz/graphql/authorization_todo.txt. Two administrator mutations return them, so a token that can run the mutation gets null for that part of the payload: the locking group from AdminSetDuoAvailability, and the connection check result from AiSelfHostedModelConnectionCheck. A legacy token gets them.

As agreed in !267273 (comment 4195231927), I will send this domain's types in one merge request, which closes this issue.

Proposal

Each type declares, with parent_authorizes:, the permission the mutation that returns it already checks, with a spec for each:

• AdminDuoAvailabilityLockedAncestor: lock_namespace_duo_feature, which AdminSetDuoAvailability checks on the group it changes. The mutation returns the type as conflictingAncestor and affectedAdminLockedDescendants.
• CloudConnectorProbeResult: check_ai_self_hosted_model_connection, which AiSelfHostedModelConnectionCheck checks on the instance. The mutation returns the type as result.

I expect no new permission.

Related to #593878.

I found this while working on gitlab-mcp-server.