Remove additional_scopes from granular token authorization

What does this MR do and why?

A granular token permission names the operation an API caller asked for. The token is checked against one boundary, the resource in the request path. additional_scopes was built to require a second permission on a second resource named in a request parameter. 2 mutations adopted it in 19.4 and both were removed in !256181 (merged), so nothing declares it now.

This removes the keyword and the requirement_group plumbing that only served it. requirement_group grouped directives so each group could be authorized separately, so dropping it collapses extract_groups back into extract and reads the permissions off the directives directly.

Behaviour is unchanged. The GranularScope directive loses its requirementGroup argument, so the GraphQL reference and both introspection dumps are regenerated.

The :granular_pat factory keeps its additional_scopes transient. A token can hold several granular scopes whatever this keyword does, and spec/requests/api/graphql/project/merge_request_spec.rb and spec/requests/api/graphql/project/autocomplete_users_spec.rb both build one that way. Removing the transient fails those specs.

assignable_when shipped after additional_scopes and is interleaved with it in several files. It is deliberately kept and its specs still pass.

One stale comment is left on purpose. ee/app/graphql/mutations/work_items/types/update.rb mentions additional_scopes: above authorize_archive_for_granular_token!. !256243 (merged) deletes that whole method, so editing it here would only create a conflict.

References

• Rule this removal follows: !254840 (merged)
• Removed the 2 consumers: !256181 (merged)
• Reverts the framework added in: !249562 (merged)

Screenshots or screen recordings

No UI change.

How to set up and validate locally

bundle exec rake gitlab:permissions:validate

bundle exec rspec spec/lib/gitlab/graphql/authz/ spec/tasks/gitlab/permissions/ spec/lib/api/helpers_spec.rb

bundle exec rspec \
  spec/requests/api/graphql/project/merge_request_spec.rb \
  spec/requests/api/graphql/project/autocomplete_users_spec.rb

bundle exec rake gitlab:graphql:compile_docs gitlab:graphql:generate_all_introspection_schemas

grep -rn "requirement_group" app ee lib spec returns nothing. additional_scope remains only in the factory, the 2 specs that use it, and the comment in types/update.rb.

No changelog entry. Nothing declares the keyword, so behaviour is unchanged, and requirementGroup is a schema-definition directive argument that clients cannot pass.