Add securityUpdateTrackedContextQuota mutation

What does this MR do and why?

This MR adds a GraphQL mutation that sets the tracked security context quota of an organization. Administrators and organization owners can use it to change the quota without the Rails console.

This mutation is the organization-level part of the quota API (&20475). !265368 adds a quota for each root namespace. After !265368, the organization quota applies only when it is set explicitly, for example with this mutation.

Changes

1. A new mutation Mutations::Security::UpdateTrackedContextQuota (securityUpdateTrackedContextQuota):

   Item	Value
   Arguments	organizationId (required) and quota (required Int).
   Authorization	update_organization (organization owners, and administrators in Admin Mode). Fine-grained tokens use the update_organization permission.
   Feature check	Returns the top-level error "Vulnerabilities Across Contexts is not enabled for this organization." when the vulnerabilities_across_contexts feature flag is disabled for the organization.
   Result	quotaInfo (the SecurityTrackedContextQuota type from !239741 (merged)) and errors.

2. The mutation writes Organizations::OrganizationSetting#security_tracked_context_quota. The mutation returns validation errors (for example, a quota below 1) in errors. It does not raise them.

3. Security::TrackedContextQuotaService#organization_setting is now public. The mutation uses it to read and write the setting.

4. A new audit event security_tracked_context_quota_updated records the previous and the new quota. The mutation does not record an event when the quota does not change or when validation fails.

5. The mutation is an Experiment, introduced in 19.6. This MR regenerates the GraphQL reference, the introspection result, the fine-grained token permissions table and the audit event types table.

Example

mutation {
  securityUpdateTrackedContextQuota(input: {
    organizationId: "gid://gitlab/Organizations::Organization/1",
    quota: 10
  }) {
    quotaInfo { limit usage remaining explicitlySet }
    errors
  }
}

How to set up and validate locally

1. Enable Vulnerabilities Across Contexts for the organization in the Rails console:

   org = Organizations::Organization.first
   Feature.enable(:vulnerabilities_across_contexts, org)

2. Run the mutation above as an organization owner, or as an administrator with Admin Mode on. Use the ID of org in organizationId.

3. Check that the response contains the new limit, and that an audit event security_tracked_context_quota_updated exists.

4. Run the specs:

   bundle exec rspec ee/spec/requests/api/graphql/mutations/security/update_tracked_context_quota_spec.rb

MR acceptance checklist

• Mutation updates Organizations::OrganizationSetting#security_tracked_context_quota
• Requires update_organization
• Validation errors returned as mutation errors
• Audit event when the quota changes
• Request specs for success, audit events, invalid quota, missing organization, members who are not owners, non-members, granular tokens and the feature check
• GraphQL docs regenerated

Related issues

Closes #585972 (closed)

Part of &20475 (Tracked Context Quota Management)