Draft: Show advanced configuration in each trigger card [ci skip]

What does this MR do and why?

Layout option 2 of 3 for showing a secret detection profile's analyzer settings. This one follows @c_north's direction: put the variables next to the scan trigger they belong to, rather than in one section for the whole profile.

Each trigger card in the scan profile details modal gains an Advanced configuration table holding only that trigger's own settings. AdvancedConfigurationTable drops its Trigger column when every row shares one trigger, so the same component reads correctly inside a card and outside one.

The three options

	Layout
Draft: Show advanced configuration in the profi... (!252986 - closed)	one table at the bottom, a row per trigger per setting
this MR	a table inside each trigger's card
Draft: Show one advanced configuration per prof... (!253279 - closed)	one table at the bottom, one row per setting for the whole profile

Discussion: Advanced Secret Detection Configuration Profile (gitlab-org#20198)

Screenshots

References

• issue: [Frontend] Support custom Secret Detection prof... (#624190 - closed)
• follow-up issue that reuses the table in the drawer: [Frontend] Scan profile drawer: view, create, e... (#624191 - closed)
• epic: Advanced Secret Detection Configuration Profile (gitlab-org#20198)
• designs: Design: Advanced Configuration Profiles management (gitlab-org#23403)
• backend implementation plan for per-trigger configuration: [Backend] Advanced profiles: Implementation plan (#604721 - closed)
• the field to CI variable mapping these names come from: ee/app/models/security/scan_profiles/configuration/ci_variables.rb
• why secret push protection carries no configuration: UNCONFIGURABLE_TRIGGER_TYPES_BY_SCAN_TYPE in ee/app/models/security/scan_profile_trigger.rb

How to set up and validate locally

0. git checkout 624190-advanced-configuration-per-trigger
   echo "Feature.enable(:configurable_security_scan_profiles)" | gdk rails c

1. have a GitLab Ultimate licence

2. be Maintainer, Owner or Security Manager on the root group

3. create a custom secret detection profile with configuration on two triggers

   • open GraphiQL at /-/graphql-explorer and run the mutation below, substituting the root group's gid://gitlab/Group/<group_id>
   • GIT_PUSH_EVENT deliberately carries no configuration, since the backend rejects one
   • the default branch trigger sets only two settings, so you can see unset ones being hidden
   expand for the create mutation

   mutation {
     securityScanProfileCreate(
       input: {
         namespaceId: "gid://gitlab/Group/<group_id>"
         scanType: SECRET_DETECTION
         name: "Advanced configuration demo"
         description: "Configuration on the two configurable triggers"
         stripDefaults: false
         triggers: [
           { triggerType: GIT_PUSH_EVENT }
           {
             triggerType: MERGE_REQUEST_PIPELINE
             configuration: {
               secretDetection: {
                 secureAnalyzersPrefix: "registry.gitlab.com/security-products"
                 imageSuffix: FIPS
                 historicScan: true
                 logOptions: "--all"
                 excludedPaths: ["spec/fixtures/**", "**/*.min.js"]
                 rulesetGitReference: "refs/heads/main"
               }
             }
           }
           {
             triggerType: DEFAULT_BRANCH_PIPELINE
             configuration: {
               secretDetection: {
                 imageSuffix: DEFAULT
                 historicScan: false
               }
             }
           }
         ]
       }
     ) {
       scanProfile {
         id
         name
       }
       errors
     }
   }

4. go to a project in that group => Secure => Security configuration

5. select the Preview profile button on the row for the custom profile - the eye icon in the actions column

6. expand the Merge Request Pipelines card and check that:

   • it holds an Advanced configuration heading and a Setting / Value table
   • there is no Trigger column, since every row belongs to this card's trigger
   • all six settings appear

7. expand the Branch pipelines (default only) card and check that:

   • only the two settings that were given values appear
   • SECRET_DETECTION_HISTORIC_SCAN shows No rather than being hidden, since false is a set value

8. expand the Secret push protection card and check that it shows no Advanced configuration heading or table at all

the trigger cards

9. check that the merge request and default branch cards:
   • no longer show a Scope: row
   • no longer promise a full repository scan or every vulnerability in their descriptions
   • still show their Target branch: and Results: rows, which the settings cannot contradict

to run tests

yarn jest ee/spec/frontend/security_configuration/components/scan_profiles