Expose every policy violation error code in the GraphQL enum

What does this MR do and why?

Security::ScanResultPolicyViolation::ERRORS defines eight error codes that a violation can store, and Security::ScanResultPolicies::PolicyViolationDetails#errors passes any of them straight through to the PolicyError.error GraphQL field. PolicyViolationErrorType only defined four of them, so serialising a violation carrying EVALUATION_SKIPPED, PIPELINE_FAILED, TARGET_SCAN_MISSING or TARGET_PIPELINE_MISSING raised inside GraphQL and the whole query answered with a 500.

This MR defines the four missing values with descriptions matching the messages in PolicyViolationDetails::ERROR_MESSAGES, adds a spec that pins the enum to the model constant so a future error code cannot be added without exposing it, and updates the GraphQL reference docs.

References

• Resolves #628376
• Related root cause: #627280

Differences

Before: Querying mergeRequest.policyViolations.errors on a merge request where any violation carries one of the four undefined codes returns HTTP 500.

After: The query returns the violation with error: EVALUATION_SKIPPED (or the corresponding code) and the message already produced by PolicyViolationDetails.

How to set up and validate locally

1. On a project with a merge request approval policy, create a merge request whose policy evaluation is skipped by UnblockPendingMergeRequestViolationsWorker, or in a Rails console update a Security::ScanResultPolicyViolation so violation_data['errors'] contains { 'error' => 'EVALUATION_SKIPPED' }.

2. Run this query in GraphiQL:

   {
     project(fullPath: "group/project") {
       mergeRequest(iid: "1") {
         policyViolations { errors { error message reportType } }
       }
     }
   }

3. On master the request fails with a 500. With this MR it returns the error entry.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.