Add feature_flags endpoint to WorkItem REST API (EE)

What does this MR do and why?

Adds a paginated feature_flags sub-endpoint for the WorkItem development widget, exposing the feature flags associated with a work item — matching the GraphQL development widget's feature_flags field (EE::Types::WorkItems::Widgets::DevelopmentType). EE only.

Part of implementing the full development widget for the WorkItem REST API (#601071 (closed)). Collection fields live on dedicated paginated sub-endpoints (like award_emoji) rather than inline on the widget entity.

Changes

• GET /namespaces/:id/-/work_items/:iid/feature_flags (+ project and group scopes), mounted in the EE API.
• New FeatureFlag entity exposing id, name, active, path, and reference.
• Row-level authorization with read_feature_flag so flags the user cannot read are filtered out, mirroring the GraphQL connection.

Related

• Part of #601071 (closed)

---

Set up and validate locally

Prerequisites: a running GDK with the work_item_rest_api feature flag enabled:

# rails console
Feature.enable(:work_item_rest_api)

Seed data — link a few feature flags to a work item. Create them out of alphabetical order so the response demonstrates the ORDER BY name used for pagination:

project   = Project.find_by_full_path('your-group/your-project')
work_item = project.issues.find_by(iid: <WORK_ITEM_IID>)

%w[zeta_rollout alpha_checkout mid_payments].each do |name|
  flag = project.operations_feature_flags.create!(name: name, active: true, version: :new_version_flag)
  work_item.feature_flag_issues.create!(feature_flag: flag)
end

Create a personal access token with the api scope and export TOKEN=<token>.

Call the endpoint (project, namespace, and group scopes):

# project scope
curl --header "PRIVATE-TOKEN: $TOKEN" \
  "http://gdk.test:3000/api/v4/projects/<PROJECT_ID>/-/work_items/<IID>/feature_flags"

# namespace scope (URL-encode the full path)
curl --header "PRIVATE-TOKEN: $TOKEN" \
  "http://gdk.test:3000/api/v4/namespaces/<group%2Fproject>/-/work_items/<IID>/feature_flags"

# group scope — a group-level work item has no feature flags, so returns []
curl --header "PRIVATE-TOKEN: $TOKEN" \
  "http://gdk.test:3000/api/v4/groups/<GROUP_ID>/-/work_items/<IID>/feature_flags"

Each row exposes id, name, active, path, and reference. Results are ordered by name so LIMIT/OFFSET pagination stays stable across pages, matching FeatureFlagsFinder.

Edge cases: unknown work item → 404; no token → 401; work_item_rest_api disabled → 403.

Screenshots

Project-scope response — note the ids (2, 3, 1) are returned in name order, not insertion order:

Pagination across two pages plus edge cases — pages neither overlap nor skip rows:

---