Backport of 'Fix SM direct access spec to expect 403' into 18.11

What does this MR do and why?

Backport of !233142 (merged) (Fix SM direct access spec to expect 403) to the 18.11 stable branch. QA/spec-only change.

!226059 (merged) (milestone 18.11) intentionally disabled code suggestions direct access, which broke e2e code suggestions tests in the ai-gateway job. The spec update (!233142 (merged)) merged on 2026-04-30 — after the 18-11-stable-ee branch cut (2026-04-14) — so every 18.11 backport ai-gateway e2e job fails the same three "when direct access on Self-managed" specs:

• E.g.: !240121 (comment 3448401601), !238743 (comment 3419026825), and !233886 (comment 3314208809)
• previously explained on !238743 (merged) (merged) by the spec-fix author
• original master failures: https://gitlab.com/gitlab-org/quality/test-failure-issues/-/work_items/41699

19-0-stable-ee (cut 2026-05-18) already contains the fix and its ai-gateway job passes.

MR acceptance checklist

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The MR that fixed the bug on the default branch has been deployed to GitLab.com (not applicable for documentation or spec changes).
• The MR title is descriptive (e.g. "Backport of 'title of default branch MR'"). This is important, since the title will be copied to the patch blog post.
• Required labels have been applied to this merge request
• This MR has been approved by a maintainer (only one approval is required).
• Ensure the e2e:test-on-omnibus-ee job has succeeded, or if it has failed, investigate the failures. If you determine the failures are unrelated, you may proceed.