Add a Source column to the artifact version table

What does this MR do and why?

This change is behind the feature flag :artifact_registry_ui

The version table listed only Version and Published, so nothing said where a version came from or who published it. This adds a Source column to the Maven/npm version table that renders a linked or unlinked commit sha, or "Manually published," alongside the publishing project and author wherever the API resolves them.

Line one	Line two	When
shortened sha, linked	<project> by <author>	commit, project and publisher all resolved
shortened sha, linked	<project>	no publisher
shortened sha, unlinked	by <author>	the project did not resolve
shortened sha, unlinked	absent	commit only
Manually published	by <author>	no commit
Manually published	absent	no attribution at all

Changes

• Declares the contract fields Step 15 left out. api/openapi/v1.yaml's Version schema requires created_by, project_id, and git_commit_sha as keys but types all three nullable, documenting created_by and project_id as "Opaque GitLab user ID / project ID … which the consumer resolves." The monolith is that consumer, so graphql/typedefs.graphql now declares ArtifactRegistryVersion.createdBy: UserCore and .project: Project instead of raw id strings — the same shape ArtifactRegistryRepository.createdBy already uses in the same file. Step 15 left these fields undeclared under an "only what renders" rule, so this is purely additive.
• Container manifests get no Source column, on contract grounds. ContainerManifest in the same OpenAPI schema carries no created_by, project_id, or git_commit_sha. This touches versions_table.vue and never the manifests table.
• Degradation is the point. Every field is nullable, and a project the viewer cannot read resolves to null. That's why the sha renders unlinked instead of the cell disappearing.
• Reuses existing utilities instead of hand-rolling. truncateSha from ~/lib/utils/text_utility shortens the sha (the package registry's publish_method.vue hardcodes substring(0, 8) instead — this does not). projectCommitPath from ~/lib/utils/path_helpers/repository addresses the commit as the generated Rails route helper, correctly resolving an organization-scoped project path where string concatenation would not. A single commitPath util in utils.js returns null when either the project or the sha is missing, reducing the template's link-or-text branch to one truthiness check.
• Two departures from the design proposal. The proposal draws a CI ref link ("3.3.0-SNAPSHOT" next to a branch icon); Artifact Registry stores no CI ref and no pipeline, so neither renders. The publisher is plain text rather than an avatar link, matching the proposal, even though the artifact registry's own detail/attributed_timestamp.vue uses an avatar for a sidebar affordance — not appropriate for a table row.
• Seeds all four attribution shapes. The six-version ladder in graphql/seed_data.js now carries per-row attribution: two full CI publishes, two manual publishes with a publisher, one commit whose project did not resolve, and one version with no attribution at all — every state is reachable in a browser, not only under Jest.
• Adds three new i18n strings and one column header. ArtifactRegistry|Manually published (the package registry's equivalent msgid is namespaced to PackageRegistry, so it can't be reused), ArtifactRegistry|%{project} by %{author}, ArtifactRegistry|by %{author}, and ArtifactRegistry|Source. Whole phrases go through GlSprintf, with each slot guarded on the entity it renders so a null project is never dereferenced — the same guard ~/packages_and_registries/shared/components/publish_message.vue uses.
• Tests. versions_table_spec.js walks all four attribution shapes over a new mockAttributedVersions fixture; utils_spec.js covers commitPath including every null path; seed_data_spec.js asserts the ladder contains all four shapes. A VersionsWithSources Storybook story renders the matrix in one view. 944 tests pass on Vue 2 and Vue 3.

truncateSha yields 8 characters where the design proposal draws 7. The monolith convention wins.

Version attribution discloses which project published an artifact and its commit shas, which matters for a public repository; the package registry gates equivalent attribution behind a separate permission. Closed beta is private-only, so this is a note for GA rather than a blocker here.

Screenshots or screen recordings

Rows four and six are the degraded states: a commit whose project did not resolve, rendering an unlinked sha, and a version with no attribution at all.

How to set up and validate locally

1. Enable the flag: Feature.enable(:artifact_registry_ui).
2. Visit /o/<organization>/-/artifact_registry/acme/repositories.
3. Open payment-core (Maven) and click the artifact name; do the same for ui-components (npm).
4. Confirm the Source column renders last, after Published, and that the six rows show: two linked shas with payments-svc by Alex Turner, one unlinked sha with by Alex Turner only, two Manually published with by Maria Santos, and one bare Manually published.
5. Follow a sha link and confirm it lands on the publishing project's commit path.
6. Open payment-service (Docker) and confirm the container path is unchanged.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.