Protected terraform states: Add GraphQL update mutation

What does this MR do and why?

Add the updateTerraformStateProtectionRule GraphQL mutation and its backing UpdateRuleService. Maintainers can update existing protection rules with partial updates — only changed fields need to be provided.

Part of the protected Terraform states feature. Adds the update mutation, building on the GraphQL create MR.

What's included:

• Terraform::StateProtectionRules::UpdateRuleService (PORO with Gitlab::Allowable, takes rule + current_user + params, filters with ALLOWED_ATTRIBUTES)
• Mutations::Terraform::StateProtectionRule::Update mutation finding rules by GlobalID via authorized_find!
• All arguments except id are required: false for partial updates
• state_name uses validates: { allow_blank: false } to reject blank values at the GraphQL layer
• Feature flag: gated behind protected_terraform_states (raise_resource_not_available_error! when disabled)
• Experiment milestone 18.11 on all new type fields, enum values, and optional mutation arguments/fields
• Policy spec for StateProtectionRulePolicy
• Service spec and mutation request spec covering full/partial updates, validation errors, feature flag disabled, and unauthorized access

🛠️ with ❤️ at Siemens

References

• Epic: &15118
• Issue: #594002 (closed)
• Reference pattern: Packages::Protection::UpdateRuleService

Screenshots or screen recordings

Not applicable — backend-only changes.

How to set up and validate locally

1. Create a protection rule via Rails console or the create mutation

2. Run the following GraphQL mutation as a maintainer:

   mutation {
     updateTerraformStateProtectionRule(input: {
       id: "gid://gitlab/Terraform::StateProtectionRule/1"
       minimumAccessLevelForWrite: OWNER
       allowedFrom: CI_ON_PROTECTED_BRANCH_ONLY
     }) {
       terraformStateProtectionRule {
         stateName
         minimumAccessLevelForWrite
         allowedFrom
       }
       errors
     }
   }

3. Verify unauthorized users get a permission error

4. Verify that disabling the feature flag returns an error:

   Feature.disable(:protected_terraform_states)

MR acceptance checklist

• Tests added for all new functionality
• RuboCop passes with no offenses