Fetch the router snapshot through the Files API

What does this MR do and why?

scripts/cells/check_router_routes_sync.rb downloaded the HTTP Router snapshot from /-/raw, whose unauthenticated rate limit is low enough that the cells-routes:router-in-sync job could fail under normal pipeline load, as raised in the review of !252485 (merged).

This MR reads the file through the Repository Files API raw endpoint instead and sends CI_JOB_TOKEN as JOB-TOKEN when the script runs in CI, so the request is authenticated. CI_API_V4_URL is honoured so the job works on other instances; CELLS_ROUTER_PROJECT, CELLS_ROUTER_REF and CELLS_ROUTER_SNAPSHOT_URL keep their meaning. The script still runs on plain Ruby with no bundle (cgi is stdlib).

I verified the new URL serves the snapshot unauthenticated: GET /api/v4/projects/gitlab-org%2Fcells%2Fhttp-router/repository/files/test%2Froutes%2Fgitlab_routes.json/raw?ref=main returns 200 with the JSON.

No changelog entry: CI tooling only.

References

• Resolves #628656 (closed)
• Origin: !252485 (comment 3819186677)

Differences

Before: The job fetches https://gitlab.com/gitlab-org/cells/http-router/-/raw/main/test/routes/gitlab_routes.json anonymously.

After: The job fetches $CI_API_V4_URL/projects/gitlab-org%2Fcells%2Fhttp-router/repository/files/test%2Froutes%2Fgitlab_routes.json/raw?ref=main with the job token.

How to set up and validate locally

1. Run the script from the repository root with plain Ruby:

   ruby scripts/cells/check_router_routes_sync.rb

2. The first output line shows the API URL being fetched; the comparison result is unchanged from master.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.