Add part-authorization to AEs

What does this MR do and why?

Aggregation Engines currently support authorization only at the GraphQL field level: once a user can query an engine, every metric, dimension, and filter it exposes is visible to them, with no finer control.

This MR introduces part-level authorization, letting individual metrics, dimensions, and filters declare their own authorize: option, checked either as a policy ability against the queried groups or projects, or via a custom check.

When a user isn't authorized for a given part, the behavior differs depending on the part type:

• Protected metrics are silently omitted, returning null without changing the response shape.
• Requests that reference a protected dimension, filter, or sort order fail validation with a clear error.

This makes it possible for a single engine to expose sensitive data points, such as metrics intended only for users with elevated access, alongside general ones, rather than requiring separate engines or locking down the whole field.

This is developer-facing infrastructure: existing engines keep working unchanged unless they explicitly opt in. Developer documentation in doc/development/aggregation_engines.md has been updated to cover the new option.

References

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/622637

Screenshots or screen recordings

No UI changes.

How to set up and validate locally

1. Add an authorize: option to a metric or dimension in any aggregation engine (see doc/development/aggregation_engines.md, "Part-level authorization").
2. Query the engine's GraphQL field as a user with and without the required access.
3. Verify unauthorized metrics return null, and requests using unauthorized dimensions, filters, or sort orders return a validation error.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #622637