Authorize 3 Composition Analysis GraphQL types for fine-grained tokens

Summary

A fine-grained personal access token is denied the Composition Analysis GraphQL types below: they declare no authorize_granular_token directive and are still listed in config/authz/graphql/authorization_todo.txt, so Query.spdxLicenses and Query.packageMetadataAdvisory give the token null, and Query.packageMetadataAdvisories a list of null advisories. A legacy token can use them.

As agreed in !267273 (comment 4195231927), I will send this domain's types in one merge request, which closes this issue.

Proposal

• authorize_granular_token with read_metadata on the instance for SpdxLicense and PackageMetadataAdvisory, and the same check on the resolver of Query.packageMetadataAdvisories. Both hold catalogue data that is the same for every user, like SecurityScanProfileVariable, which declares the same permission.
• PackageMetadataAdvisoryIdentifier is returned only below an advisory, so it declares the permission its parent checks (parent_authorizes:), with a spec for that parent.

I expect no new permission.

Related to #593878.

I found this while working on gitlab-mcp-server.