Clarify protected branch creation permissions in documentation

Navrequested to merge
docs-clarify-protected-branch-creation-permissions into master

What does this MR do and why?

This MR updates the protected branches documentation to clarify that users with "Allowed to merge" permission can create protected branches via the UI and API. This addresses confusion reported in issue #551953 (closed).

Related issues

Closes #551953 (closed)

Documentation changes

  • Added a new section explaining protected branch creation permissions
  • Clarified that "Allowed to merge" permission enables branch creation via UI/API
  • Explained why this behavior is expected and secure

Security considerations

This is a documentation-only change that clarifies existing expected behavior. No code changes are needed as the current implementation is working as designed.

The behavior is secure because:

  • Users with "Allowed to merge" permission can effectively push any changes to protected branches through merge requests anyway
  • Branch creation via UI/API still requires the commit to be from an existing protected branch
  • All existing protection rules and approval processes still apply

Merge request reports