Add granular token authorization to Admin & platform mutations

What does this MR do and why?

Adds granular token authorization to the group 12 (Admin, platform & remaining) GraphQL mutations from config/authz/graphql/authorization_todo.txt.

For each mutation this adds an authorize_granular_token directive, the raw and assignable permission definitions it needs, and a request-spec authorization test per declared boundary type (following the GraphQL implementation guide). The corresponding mutation: lines are removed from the authorization todo list and the generated doc/auth/tokens/fine_grained_access_tokens_graphql.md is regenerated.

31 mutations are covered; 6 are intentionally left in the todo list (see the skip table and rationale below).

Mutations covered

Mutation	Permission	Boundary
AdminSidekiqQueuesDeleteJobs	drop_sidekiq_job	instance
CreateCustomDashboard	create_custom_dashboard	instance
UpdateCustomDashboard	update_custom_dashboard	instance
DeleteCustomDashboard	delete_custom_dashboard	instance
EnableDevopsAdoptionNamespace	enable_devops_adoption	group (namespace_id)
GeoRegistriesBulkUpdate	update_geo_registry	instance
GeoRegistriesUpdate	update_geo_registry	instance
GitlabSubscriptionActivate	update_gitlab_subscription	instance
IntegrationExclusionCreate	create_integration_exclusion	instance
IntegrationExclusionDelete	delete_integration_exclusion	instance
NamespaceBanDestroy	delete_namespace_ban	group (id → namespace)
NamespaceCreateRemoteDevelopmentClusterAgentMapping	create_cluster_agent_mapping	group (namespace_id)
NamespaceDeleteRemoteDevelopmentClusterAgentMapping	delete_cluster_agent_mapping	group (namespace_id)
NamespaceSettingsUpdate	update_ci_namespace_settings	group (full_path)
NamespacesRegenerateNewWorkItemEmailAddress	read_namespace	project (full_path)
OrbitUpdate	update_knowledge_graph_setting	group (group_path)
OrganizationCreateClusterAgentMapping	create_cluster_agent_mapping	instance
OrganizationDeleteClusterAgentMapping	delete_cluster_agent_mapping	instance
ProcessUserBillablePromotionRequest	update_member_approval	instance
UpsertFlatUserCap	update_subscription_usage_cap	group (namespace_path) + instance
UpsertUserBudgetCapOverrides	update_subscription_usage_cap	group (namespace_path) + instance
UserAddOnAssignmentCreate	create_add_on_assignment	group (add_on_purchase_id → namespace)
UserAddOnAssignmentBulkCreate	create_add_on_assignment	group (add_on_purchase_id → namespace)
UserAddOnAssignmentRemove	delete_add_on_assignment	group (add_on_purchase_id → namespace)
UserAddOnAssignmentBulkRemove	delete_add_on_assignment	group (add_on_purchase_id → namespace)
ValueStreamCreate	create_value_stream	group + project (namespace_path)
ValueStreamDestroy	delete_value_stream	group + project (id → namespace)
ValueStreamUpdate	update_value_stream	group + project (id → namespace)
VerifiedNamespaceCreate	create_verified_namespace	instance
WorkspaceCreate	create_workspace	project (project_id)
WorkspaceUpdate	update_workspace	project (id → project)

Multi-boundary mutations (ValueStream*, Upsert*) have one authorization test per declared boundary type.

Judgment calls

• Organization-scoped resources use an instance boundary. CustomDashboard* and OrganizationCluster* authorize against an Organization, which is not a Project/Group boundary; instance is the honest standing boundary.
• Permissions are reused where one already existed (read_namespace, update_gitlab_subscription, update_subscription_usage_cap, update_ci_namespace_settings, update_knowledge_graph_setting, *_custom_dashboard, drop_sidekiq_job); new raw permissions were created for value streams, workspaces, cluster-agent mappings, add-on assignments, Geo registries, integration exclusions, member approval, namespace bans, verified namespaces and DevOps adoption.

Skipped mutations (left in the todo list)

Mutation	Reason
BulkEnableDevopsAdoptionNamespaces	Boundary argument is a GlobalID array; the extractor cannot resolve an array boundary
DisableDevopsAdoptionNamespace	Boundary argument is a GlobalID array; the extractor cannot resolve an array boundary
CreateAnnotation	Deprecated no-op that always raises ResourceNotAvailable; no boundary
DeleteAnnotation	Deprecated no-op that always raises ResourceNotAvailable; no boundary
EchoCreate	Diagnostic no-op; no boundary
DevfileValidate	Stateless validation utility; no boundary

How validated

• bundle exec rake gitlab:permissions:validate — passes (permission/assignable definitions valid, GraphQL permissions valid, docs up to date).
• bundle exec rake gitlab:permissions:graphql:compile_docs — regenerated doc committed.
• RuboCop clean on all changed files.
• Authorization request specs run in CI.