Allow CI job token to access repository archive API

What does this MR do and why?

Allow CI job token to access repository archive API, solves #602168

Composer 2.10 disables source-fallback for dist downloads, so pipelines that authenticate with CI_JOB_TOKEN can no longer fetch private packages via the archive endpoint even though git clone with the same token works.

This opts the archive API route into the existing read_repositories job token policy.

References

• #602168
• https://blog.packagist.com/composer-2-10-release/#deprecating-source-fallback
• https://github.com/composer/composer/pull/12885
• https://github.com/composer/composer/issues/12984
• https://github.com/composer/composer/pull/12916

How to set up and validate locally

In a GitLab instance (assuming either the public one or gitlab.example.com:

1. create a php-dependency project that contains a composer.json like this:

{
    "name": "my/php-dependency"
}

2. create a php-project project that contains a composer.json like this:

{
    "name": "my/php-project",
    "require": {
        "my/php-dependency": "*"
    },
    "repositories": [
        {
            "name": "my/php-dependency",
            "type": "vcs",
            "url": "https://gitlab.example.com/my-group/php-dependency.git" # replace with correct domain / GitLab group
        }
    ],
    "config": { # needed if NOT using the public GitLab instance
        "gitlab-domains": [
            "gitlab.example.com"
        ],
    }
}

3. Add a .gitlab-ci.yml like this:

Test:
  script:
    # for public GitLab instance
    - composer config http-basic.gitlab.com -- gitlab-ci-token "$CI_JOB_TOKEN"
    # for self-hosted GitLab instance
    - composer config http-basic.gitlab.example.com -- gitlab-ci-token "$CI_JOB_TOKEN"
    - composer install

5. Run the pipeline

MR acceptance checklist

• self-reviewed
• test added
• spec added
• security impact evaluated (no change, same data - and more - is reachable via git clone)
• no breaking changes
• no performance, reliability, availability impacts
• docs updated