Remove the gate_token_exchange_endpoint feature flag

What does this MR do and why?

Removes the gate_token_exchange_endpoint feature flag from POST /api/v4/token_exchange.

The flag was added in !236798 (merged) while the Artifact Registry integration was in development. The integration is complete and the closed beta is going out to customers, so the flag is no longer needed.

Current flag state

• On GitLab.com production the flag is enabled for a single user.
• On staging, staging-ref, pre and dev it is enabled globally.

Effect of this change

• Every authenticated caller can use the endpoint.
• Self-managed instances do not need to enable a flag.
• The flag only decided whether the endpoint returned 404 or issued a token. It did not gate any data write, cache key or state transition.
• The endpoint keeps route_setting :lifecycle, :experiment so it stays exempt from the breaking change policy. Access is controlled on the Artifact Registry side, so it does not need a flag of its own.

Related cleanup in the diff

• The 404 response is removed from the endpoint description because it only existed for callers without the flag.
• doc/api/openapi/openapi_v3.yaml is regenerated.

After merge

/chatops run feature delete gate_token_exchange_endpoint --dev --pre --staging --staging-ref --production

How to set up and validate locally

1. Run the request specs for the endpoint.

   bin/rspec ee/spec/requests/api/authn/token_exchange_spec.rb

2. Without enabling any feature flag, call the endpoint with a personal access token. The response is 201 with a token field.

   curl --request POST --header "PRIVATE-TOKEN: <token>" --data "audience=gitlab-artifact-registry" "http://gdk.test:3000/api/v4/token_exchange"

References

• Epic: &22052 (closed)
• Slack thread where the Artifact Registry team asked whether the flag is still needed: https://gitlab.slack.com/archives/C06LTTM5EUD/p1788394846660679