Add granular token support for design image endpoints

What does this MR do and why?

Follow-up to !246866 (merged), which added token authentication for design management images but denies granular PATs outright, because no design permission was assignable and authorize_granular_token! therefore had nothing to enforce (see the AppSec discussion in !246866 (comment 3598447904)).

This MR adds real granular token support for the design image endpoints:

• Defines the read_design raw permission (config/authz/permissions/design/read.yml) and removes it from definitions_todo.txt.
• Grants read_design through the existing Work Item: Read assignable permission rather than a standalone "Design: Read" toggle. Designs are subordinate to work items, and keeping discovery (GraphQL design metadata) and retrieval (image endpoints) under one permission avoids tokens that can fetch images they cannot discover, and vice versa. Correction: an earlier version of this description claimed design metadata was already granted to granular tokens through read_issue on Types::IssueType — that was wrong. DesignType/DesignCollectionType carry no authorize_granular_token directive, and granular tokens are denied by default on types without one, so granular tokens currently cannot read design metadata through GraphQL at all, regardless of scope. Adding those directives (gated by read_design) is a follow-up — see the discussion in !246945 (comment 3607328280).
• Maps the :design sessionless format to read_design in GranularTokenAuthorization::GRANULAR_FORMAT_PERMISSIONS, so authorize_granular_token! enforces granular scopes on these requests like it does for archive and download.
• Removes the temporary outright denial of granular tokens from Projects::DesignManagement::DesignsController.
• Adds read_design to the public_anonymous role so granular tokens without an explicit scope keep working on public projects, matching anonymous access (authorize_read_design! still applies).
• Replaces the granular-deny shared example with three cases: a granular PAT with Work Item: Read on the project is served the image; one holding only an unrelated permission (Release: Read) on the same project gets a 404; one without any scope gets a 404.

Dependency: this MR targets the branch of !246866 (merged) and is marked Draft until that MR merges; it should be retargeted to master afterwards (GitLab does this automatically when the parent branch is deleted on merge).

How to set up and validate locally

1. On a private project, add a design to an issue and create a granular PAT whose scope grants Work Item: Read on that project.
2. curl -i -H "PRIVATE-TOKEN: <token>" "<raw_image url>" returns the image (200).
3. A granular PAT without that permission (for example, scoped to an unrelated project) gets a 404.
4. bundle exec rake gitlab:permissions:validate passes.

References

• Parent MR: !246866 (merged)
• AppSec review discussion: !246866 (comment 3598447904)