Add canPushInitialCommit GraphQL field

What does this MR do and why?

Contributes to #415846 (closed)

Problem

When a developer creates a new project in a namespace where the default branch is fully protected, the "Initialize with README" checkbox is shown as enabled even though the push will fail. This leads to repositories that are not initialized.

Solution

Add can_initial_push? to DefaultBranchProtection and can_push_initial_commit? to Namespace to determine if a user can push the initial commit based on their role and branch protection settings. Expose this as a canPushInitialCommit GraphQL field on NamespaceType. Refactor ProtectedBranch.protected_ref_accessible_to? to use the new logic and remove the now-unused Project#initial_push_to_default_branch_allowed_for_developer?.

This is the backend portion of the fix. A follow-up MR will consume the new GraphQL field in the frontend to disable the checkbox in the new project form.

References

• #415846 (closed)

How to set up and validate locally

1. Create a group with default branch protection set to "Fully protected".
2. Add a user with Developer role to the group.
3. Open the GraphiQL explorer (/-/graphql-explorer) as that user and run:

   {
     currentUser {
       groups(first: 5) {
         nodes {
           name
           canPushInitialCommit
         }
       }
       namespace {
         canPushInitialCommit
       }
     }
   }

4. Verify canPushInitialCommit is false for the fully-protected group and true for the user's personal namespace.
5. Sign in as a Maintainer of the same group and verify canPushInitialCommit is true.

Screenshot

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.