Add commit summary fields to the Pipeline GraphQL type

What does this MR do and why?

Related to Pipelines list: Guest role sees "Can't find HEA... (#627161 - closed).

Adds three fields to the Pipeline GraphQL type, gated by the type's existing read_pipeline authorization: commitTitle, commitAuthorName, commitAuthorGravatar.

Guests on private projects get null for Pipeline.commit because Commit requires read_code. The pipelines list and pipeline header render as if the commit didn't exist. Until 18.10 the REST list exposed the commit through Ci::PipelineEntity with read_pipeline only: title, message, author name and email, gravatar. The new fields are a subset of that.

Resolution shares the batched Commit.lazy lookup that commit uses (with_commit). One Gitaly call per page whether commit, the new fields, or both are selected. The request spec covers Guest, Reporter, anonymous, a SHA missing from the repository, and the Gitaly call count across several pipelines.

No feature flag. The fields are additive; the frontend consumer is Bring back the commit title and author for Gues... (!255656 - merged), stacked on this MR.

How to set up and validate locally

1. Private project with a repository and a pipeline, Project-based pipeline visibility enabled.

2. Add a Guest, create a read_api token for them.

3. Query as the Guest. commit is null, the three fields are populated, no errors:

   {
     project(fullPath: "group/project") {
       pipelines(first: 3) {
         nodes {
           commitTitle
           commitAuthorName
           commitAuthorGravatar
           commit { title }
         }
       }
     }
   }

4. As a Reporter, commit.title equals commitTitle.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.