Add external MCP server block/allow and enforcement

What does this MR do and why?

Add external MCP server block/allow and enforcement

Add the block/allow mechanism and runtime enforcement for the external MCP server kill-switch. Administrators can block or allow a server for a group or project via the AiCatalogMcpServerSetBlock mutation (guarded by the block_ai_catalog_mcp_server permission), and a blocked server's tools are denied per tool call via the externalMcpBlocked workflow field, gated by the mcp_server_block_enforcement feature flag.

Blocks resolve through namespace ancestry, so a group block cascades to its descendant projects. The governance UI and audit logging are delivered separately.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/603576

Changelog: added EE: true

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

Run below graphql queries and confirm settings cascades to sub groups and projects

query groupServers{
  aiCatalogMcpServers {
    nodes {
      id
      name
      blockStatus(groupFullPath: "gitlab-duo")
    }
  }
}

mutation blockServerGroup{
  aiCatalogMcpServerSetBlock(input: {
    id: "gid://gitlab/Ai::Catalog::McpServer/6",
    groupFullPath: "gitlab-duo",
    blocked: true
  }) {
    errors
    mcpServer { name blockStatus(groupFullPath: "gitlab-duo") }
  }
}

mutation allowServerGroup{
  aiCatalogMcpServerSetBlock(input: {
    id: "gid://gitlab/Ai::Catalog::McpServer/6",
    groupFullPath: "gitlab-duo",
    blocked: false
  }) {
    errors
    mcpServer { name blockStatus(groupFullPath: "gitlab-duo") }
  }
}

mutation blockServerProject{
  aiCatalogMcpServerSetBlock(input: {
    id: "gid://gitlab/Ai::Catalog::McpServer/6",
    projectFullPath: "gitlab-duo/test-2",
    blocked: true
  }) {
    errors
    mcpServer { blockStatus(projectFullPath: "gitlab-duo/test-2") }
  }
}

mutation allowServerProject{
  aiCatalogMcpServerSetBlock(input: {
    id: "gid://gitlab/Ai::Catalog::McpServer/6",
    projectFullPath: "gitlab-duo/test-2",
    blocked: false
  }) {
    errors
    mcpServer { blockStatus(projectFullPath: "gitlab-duo/test-2") }
  }
}

query projectServers{
  aiCatalogMcpServers {
    nodes { name blockStatus(projectFullPath: "gitlab-duo/test-2") }
  }
}

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #603576