Add source_ref to Ci::PipelineFinishedEvent payload

What does this MR do and why?

Adds an optional source_ref property to the Ci::PipelineFinishedEvent schema and emits it from the publisher in app/models/ci/pipeline.rb.

This is the first of two MRs, and a no-op on its own: the property is optional and no subscriber reads it yet.

dependency_bump_mr_failure? and dependency_bump_mr_pipeline? in ee/lib/gitlab/event_store/subscriptions/dependency_management_subscriptions.rb each call Ci::Pipeline.find_by_id to check whether the pipeline's branch starts with dependency-management/. These if: conditions are evaluated synchronously at publish time, inside POST /api/v4/jobs/request, which pushed that endpoint over the Gitlab::QueryLimiting cap. A temporary override (new_threshold: 105) has been in place since !243891 (merged).

Carrying source_ref on the payload lets the follow-up MR filter on the branch name directly, drop both pipeline lookups, and remove that override.

source_ref rather than ref: for a merge request pipeline created in the target project, Ci::Pipeline#ref is refs/merge-requests/:iid/head; for one created in a fork it is the plain source branch name. Only source_ref resolves both cases back to the branch name.

The property is typed %w[string null] because p_ci_pipelines.ref is nullable.

This mirrors commit 039fbe1c36377, which added source and partition_id to this same event so dependency_management_pipeline? could filter without a query.

References

• Related to #605253 (closed)
• Gitlab::QueryLimiting override introduced in !243891 (merged)
• dependency_bump_mr_pipeline? added in !246152 (merged)

How to set up and validate locally

bundle exec rspec spec/events/ci/pipeline_finished_event_spec.rb
bundle exec rspec spec/models/ci/pipeline_spec.rb -e 'pipeline finished events'
bundle exec rspec ee/spec/lib/gitlab/event_store/subscriptions/dependency_management_subscriptions_spec.rb

The last file covers the existing subscribers, which build the event without source_ref and must keep passing unchanged.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.