Protected packages: Push protection for deploy token

• Please check this box if this contribution uses AI-generated content (including content generated by GitLab Duo features) as outlined in the GitLab DCO & CLA

What does this MR do and why?

Protected packages: Push protection for deploy token

• Ensure that a protected package cannot be published with a deploy token when there is a package protection rule that matches the package name and type
• We discussed the user expectation and concluded that deploy tokens should not be able to publish packages that are protected by a package protection rule, see #323970 (comment 1978981115)

with at Siemens

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

MR Checklist (@gerardo-navarro)

• Changelog entry added, if necessary
• Documentation created/updated via this MR
• Documentation reviewed by technical writer or follow-up review issue created
• Tests added for this feature/bug
• Tested in all supported browsers
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• Conforms to the style guides
• Conforms to the javascript style guides
• Conforms to the database guides

Screenshots or screen recordings

Before	After
Deploy tokens can always push (publish) a protected package.	Deploy tokens cannot push (publish) a package when a package protection rule exists for this package (matching only package_name and package_type, and disregarding minimum_access_level_for_push)

How to set up and validate locally

1. Enable feature flag via rails c

Feature.enable(:packages_protected_packages)

2. Create a new package protection rule through the frontend and use the following values: http://gdk.test:3000/flightjs/Flight/-/settings/packages_and_registries

• Package name pattern: @flightjs/test-npm-package-*
• Package type: :npm
• Minimum access level for push: :maintainer

3. Create a dummy project for npm package for testing publishing

# Go to a directory outside of the gitlab and gdk directory
mkdir test-npm-package && cd test-npm-package
npm init esm --yes

4. Adjust the package name in package.json and set it to "@flightjs/test-npm-package-prod" <= this should match the given package_name_pattern in step 2
5. Create or adjust file .npmrc in order to push the npm package to the GitLab registry, see https://docs.gitlab.com/ee/user/packages/npm_registry/#authenticating-via-the-npmrc
6. Create a deploy token, see https://docs.gitlab.com/ee/user/project/deploy_tokens/#create-a-deploy-token
7. Publish npm test package using the newly created deploy token

NPM_TOKEN=<deploy_token> npm publish

8. The package should be protected and should not have been published

Database review

• NPM protection rule existence check query

Related to #323970 (closed)