Add audit event for ticket closed by bot

What does this MR do and why?

This MR fixes a 500 error that occurs when closing a Service Desk ticket via the API using a project or group access token.

Problem

When a Service Desk ticket is closed using the Issues API with a project or group access token, the application returns a 500 error:

Audit event type YML file is not defined for ticket_closed_by_project_bot.

The ticket is closed successfully, but the missing audit event definition causes the request to fail.

Root Cause

The audit event name is dynamically generated in app/services/issues/close_service.rb:

if current_user.project_bot?
  log_audit_event(issue, current_user, "#{issue.issue_type}_closed_by_project_bot",
    "Closed #{issue.issue_type.humanize(capitalize: false)} #{issue.title}")
end

When issue.issue_type returns ticket, the generated audit event name becomes ticket_closed_by_project_bot. However, no corresponding YML definition existed in ee/config/audit_events/types/.

This gap exists because the ticket work item type was introduced as part of the Service Desk migration to work items after the original audit events were created in GitLab 16.1 (!121485 (merged)).

Solution

Add the missing audit event type definitions for tickets:

• ticket_closed_by_project_bot.yml
• ticket_reopened_by_project_bot.yml
• ticket_created_by_project_bot.yml (proactive, for future API support)

Why "project_bot" in the naming?

The _by_project_bot suffix is a historical artifact. Both project and group access tokens create users with user_type: project_bot (defined in app/models/concerns/has_user_type.rb). The check current_user.project_bot? returns true for both token types.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #592448 (closed)