Allow the ai_workflows scope to read repository blobs in batch

What does this MR do and why?

API::Repositories admitted the ai_workflows scope on GET and HEAD only. POST /projects/:id/repository/blobs/batch is a read whose file list travels in the request body, so a Duo workflow token was refused with insufficient_scope on content the same scope can already read one file at a time through GET files/:path/raw. The no-clone repository access path fell back to a full git clone as a result.

This MR admits the batch endpoint by path rather than widening the gate to POST in general, so the changelog endpoint (the only other non-GET route in this API) stays closed to the scope. Request specs cover both sides.

References

• Resolves #626647

Differences

Before: POST /projects/:id/repository/blobs/batch with an ai_workflows-scoped token returns 403 insufficient_scope.

After: The same request returns 200 with the blob contents. POST /projects/:id/repository/changelog with that token still returns 403.

How to set up and validate locally

1. Create an OAuth token with only the ai_workflows scope.

2. Call the batch endpoint:

   curl -s -X POST "http://gdk.test:3000/api/v4/projects/<id>/repository/blobs/batch" \
     -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
     -d '{"files":[{"path":"README.md"}]}'

3. On master the response is 403 insufficient_scope; with this MR it is the blob list.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.