Authorize UserMergeRequestInteraction for granular tokens

What does this MR do and why?

The type declared no granular token directive, so fine-grained personal access tokens were denied and reviewState returned null. Declare read_merge_request on the project boundary, matching MergeRequestType.

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.