Update project settings on projects API

What does this MR do and why?

This change adds two new configuration options for the REST API:

• protect_merge_request_pipelines - Originally introduced in: !188008 (merged)
• ci_display_pipeline_variables - Originally introduced in: !200232 (merged)

For customers who rely on automation of project settings, this is a convenient way to set both of these boolean options.

References

Screenshots or screen recordings

2025-12-18 11-34-46.mov

How to set up and validate locally

1. Create a project.
2. Confirm in Settings → CI/CD Settings → Variables that Allow merge request pipelines to access protected variables and runners is enabled by default. Display pipeline variables is not enabled.
3. Trigger an API call using the PUT (Edit) API for a project.
   1. Example: curl --request PUT --header "PRIVATE-TOKEN: <token>" --url "http://gdk.local:3000/api/v4/projects/:id" --data "protect_merge_request_pipelines=false"
   2. Both protect_merge_request_pipelines and ci_display_pipeline_variables should be settable as true or false, which will then update the GitLab UI to reflect the state on the project.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.