Fix flaky spec in spec/requests/api/merge_requests_spec.rb

What does this MR do and why?

This commit prevents a composite identity ivar from leaking between tests.

resolve_composite_identity_user calls composite_identity_enforced! on the scoped user's AR object, setting an in-memory ivar. Since let_it_be(:user) reuses the same AR object across tests, this ivar leaked to the closes_issues test, causing Ability.allowed? to fail the composite identity check and returning an empty response.

Fix by using a dedicated human_user in the composite identity test so the shared user AR object is never mutated.

At the moment, this problem appears to be happening only on 18-9-stable-ee for some reason. UPDATE: This problem happens also on 18-10-stable-ee, but not on master due to use of let_it_be_with_refind.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

How to set up and validate locally

On 18-9-stable-ee, run this sequence of tests that tests the composite identity:

bundle exec rspec --format d 'spec/requests/api/merge_requests_spec.rb:3212' 'spec/requests/api/merge_requests_spec.rb[1:23]'

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The MR that fixed the bug on the default branch has been deployed to GitLab.com (not applicable for documentation or spec changes).
• The MR title is descriptive (e.g. "Backport of 'title of default branch MR'"). This is important, since the title will be copied to the patch blog post.
• Required labels have been applied to this merge request
  • severity label and bug subtype labels (if applicable)
  • If this MR fixes a bug that affects customers, the customer label has been applied.
• This MR has been approved by a maintainer (only one approval is required).
• Ensure the e2e:test-on-omnibus-ee job has succeeded, or if it has failed, investigate the failures. If you determine the failures are unrelated, you may proceed. If you need assistance investigating, reach out to a Software Engineer in Test in #s_developer_experience.

Note to the merge request author and maintainer

If you have questions about the patch release process, please:

• Refer to the patch release runbook for engineers and maintainers for guidance.
• Ask questions on the #releases Slack channel (internal only).
• Once the backport has been merged, the commit changes will be automatically deployed to a release environment that can be used for manual validation. See after merging runbook for details.