Docs: Document that fork visibility cannot exceed upstream project

What does this MR do?

Documents the fork visibility constraints that are enforced in code but not mentioned in the documentation:

1. At fork creation, the fork's visibility is capped to the minimum of the source project's visibility, the target namespace's visibility, and the requested visibility (app/services/projects/fork_service.rb target_visibility_level). In the UI, the fork form disables less restrictive options so they can't be selected. Via the API, requesting a more permissive level does not error; GitLab silently uses the most permissive allowed level.
2. After creation, a model validation prevents changing a fork's visibility to a level greater than the upstream project's visibility (app/models/project.rb visibility_level_allowed_as_fork?). This validation runs only when the fork's own visibility changes, so an existing fork is not downgraded if the upstream project later becomes more restrictive (see spec/services/projects/fork_service_spec.rb, "when the forked project has higher visibility than the root project").

Neither constraint was documented anywhere. This MR adds the missing information to three pages:

• doc/user/project/repository/forking_workflow.md - adds a note to the Visibility level step in Create a fork.
• doc/api/project_forks.md - extends the visibility attribute description in the Create a fork of a project table.
• doc/user/public_access.md - extends the Project visibility dropdown step in Change project visibility to mention the fork constraint.

Related issues

None. This documents existing enforced behavior.

Author's checklist

• Optional. Consider taking the GitLab Technical Writing Fundamentals course.
• Follow the:
  • Documentation process.
  • Documentation guidelines.
  • Style Guide.
• If you're adding a new page, add the product availability details under the H1 topic title.
• If you are a GitLab team member, request a review based on:
  • The documentation page's metadata.
  • The associated Technical Writer.

If you are a GitLab team member and only adding documentation, do not add any of the following labels:

• ~"frontend"
• ~"backend"
• ~"type::bug"
• ~"database"

These labels cause the MR to be added to code verification QA issues.

Reviewer's checklist

Documentation-related MRs should be reviewed by a Technical Writer for a non-blocking review, based on Documentation Guidelines and the Style Guide.

If you aren't sure which tech writer to ask, use roulette or ask in the #docs Slack channel.

• If the content requires it, ensure the information is reviewed by a subject matter expert.
• Technical writer review items:
  • Ensure docs metadata is present and up-to-date.
  • Ensure the appropriate labels are added to this MR.
  • Ensure a release milestone is set.
  • If relevant to this MR, ensure content topic type principles are in use, including:
    • The headings should be something you'd do a Google search for. Instead of Default behavior, say something like Default behavior when you close an issue.
    • The headings (other than the page title) should be active. Instead of Configuring GDK, say something like Configure GDK.
    • Any task steps should be written as a numbered list.
    • If the content still needs to be edited for topic types, you can create a follow-up issue with the docs-technical-debt label.
• Review by assigned maintainer, who can always request/require the reviews above. Maintainer's review can occur before or after a technical writer review.