Remove security_attributes_policy_scope feature flag (backend)

Artur Fedorovrequested to merge
cleanup-security-attributes-policy-scope-ff-backend into master

What does this MR do?

Cleans up the backend usage of the default-enabled security_attributes_policy_scope beta feature flag (group::security policies). The feature is now permanently enabled, so the Feature.enabled? checks are removed and the new behavior becomes the baseline.

Changes

  • Removes the flag YAML definition ee/config/feature_flags/beta/security_attributes_policy_scope.yml.
  • Removes the push_frontend_feature_flag(:security_attributes_policy_scope, ...) calls from the project and group security policies controllers.
  • Removes the backend Feature.enabled?(:security_attributes_policy_scope, ...) checks in PolicyScopeChecker and PolicyScopeFetcher (the latter's now-trivial guard reduces to a container presence check, and its dead group helper is removed).
  • Updates the affected specs: drops the stub_feature_flags(security_attributes_policy_scope: false) disabled-state contexts and the have_pushed_frontend_feature_flags(securityAttributesPolicyScope: true) assertions; the enabled behavior is now the baseline.

Intentionally retained

configuration.experiment_enabled?(:security_attributes_policy_scope) in PolicyScopeChecker is intentionally kept. This is a policy-config experiment opt-in that reads the policy's experiments: block — it is not the feature flag, and its test coverage (the experiments: { security_attributes_policy_scope: { enabled: ... } } contexts) is preserved.

⚠️ Merge order

⚠️ Merge the frontend cleanup MR FIRST. This MR removes push_frontend_feature_flag and the flag YAML; merging it before the frontend MR would leave glFeatures.securityAttributesPolicyScope undefined and silently disable the attribute-scope UI.

Related to #603705 (closed)

Merge request reports