Allow deletion of non-main protected branches with bypass_settings

What does this MR do and why?

The "Policy Exception settings" for service accounts only bypass some policy rules, not all of them. Specifically, the service account exception successfully bypasses the "direct commit" restriction. However, it cannot bypass the "prevent deletion of protected branches" rule. This blocks legitimate use cases where automated deletion of non-main protected branches is required.

This MR enables bot users (service accounts and project access tokens) to bypass the block_branch_modification security policy setting when deleting protected branches. Previously, the deletion check did not check the bypass settings, so the branch deletion was blocked.

References

Screenshots or screen recordings

How to set up and validate locally

• Create a group
• Create a service account and create an access token with all scopes and save the access token
• Add the created service account as a maintainer in the group
• Create a project in the group and create a protected branch
• Create an approval policy in the group with block_branch_modification: true:

approval_policy:
  - name: Strict approval policy
    description: ''
    enabled: true
    enforcement_type: enforce
    rules:
      - type: any_merge_request
        branch_type: protected
        commits: any
    actions:
      - type: send_bot_message
        enabled: true
    approval_settings:
      block_branch_modification: true
      prevent_pushing_and_force_pushing: true
      prevent_approval_by_author: true
      prevent_approval_by_commit_author: true
      remove_approvals_with_new_commit: true
      require_password_to_approve: false
    fallback_behavior:
      fail: closed
    bypass_settings:
      service_accounts:
        - id: <ID of service account>

• Delete (Unprotect) the protected branch using the API with the access token of the service account and verify that the branch is unprotected

curl --request DELETE "http://gdk.test:3000/api/v4/projects/<PROJECT_ID>/protected_branches/<BRANCH_NAME>" \
  --header "PRIVATE-TOKEN: <TOKEN>"

• Similarly, create a group protected branch and verify that it can be deleted using the API:

 curl --request DELETE "http://gdk.test:3000/api/v4/groups/<GROUP_ID?/protected_branches/<BRANCH_NAME>" \
  --header "PRIVATE-TOKEN: <TOKEN>"

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #578753 (closed)