Expose allowed_in_workloads on CI/CD variables

What does this MR do and why?

Exposes allowed_in_workloads (column from MR 1) on project and group CI/CD variables so owners can opt a variable into GitLab Duo Agent Platform workloads:

• Settings form: permitted attribute in Projects::VariablesController and Groups::VariablesController, serialized in the variable entities.
• REST API: optional allowed_in_workloads on create and update for project and group variables, returned in the entity.
• GraphQL: allowedInWorkloads on CiProjectVariable and CiGroupVariable.

The flag is stored only; the final MR of the split makes it effective. The UI checkbox follows in MR 4b so the GraphQL field is deployed before the frontend requests it.

References

• Work item: #602887
• Split of !252729 (the original, now the final MR):

#	Merge request	Base
1	!254470 (merged) Add columns	master
2	!254471 (merged) Parse variables in agent-config.yml	master
3	!254472 Persist source ref protection	1
4a	!254473 Expose allowed_in_workloads on APIs	1
4b	!254474 Settings checkbox	4a
5	!252729 Gate workload variables (feature becomes active)	3, needs 2

Screenshots or screen recordings

Not applicable: no visible change (the checkbox is MR 4b).

How to set up and validate locally

1. Create a project variable MY_VAR in Settings > CI/CD > Variables.

2. Update it through the REST API:

   curl --request PUT --header "PRIVATE-TOKEN: <token>" \
     "http://gdk.test:3000/api/v4/projects/<id>/variables/MY_VAR" --form "allowed_in_workloads=true"

   The response contains "allowed_in_workloads": true. GET on the same path returns it too.

3. Repeat with groups/<id>/variables/MY_GROUP_VAR.

4. In GraphiQL (/-/graphql-explorer), query project(fullPath: "<path>") { ciVariables { nodes { key allowedInWorkloads } } } and see the value.

5. Reload the variables settings page: the variable still saves and its other attributes are unchanged.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.