Remove granular token checks on second boundaries

What does this MR do and why?

Granular token permissions name the operation the API caller asked for. The token is checked against the resource in the request path. A second resource named in a request parameter gets no separate token check. 2 mutations shipped in 19.4 with a second check and this removes them.

• WorkItemBulkMove required create_work_item on target_full_path. That is an assignable group of 35 raw permissions on the move target, held for the token's lifetime, and no narrower grant exists.
• ProjectSubscriptionCreate required create_pipeline_subscription on upstream_path.

This is a behaviour change. A token scoped only to the source can now move work items into a target it does not name, and the same for the subscription upstream. DeclarativePolicy still runs on both paths, so the user still needs the ability. Only the token boundary check is gone.

WorkItemTypeUpdate is deliberately left alone. It calls AuthorizeGranularScopesService directly to require archive_work_item_type when the optional archive argument is passed, but it passes the namespace resolved from full_path, which is the boundary the primary directive already declares. That is a second permission on one boundary, not a permission on a second resource, so this rule does not reach it. Removing it would also delete 2 permission definitions and change what the token creation UI offers, which is a separate decision. See #627165 (closed).

After this, nothing outside lib/api/helpers.rb declares additional_scopes.

References

• Rule this follows: !254840 (merged)
• Framework this leaves unused: !249562 (merged)
• MRs that adopted it: !245438 (merged) and !245447 (merged)

Screenshots or screen recordings

No UI change.

How to set up and validate locally

bundle exec rake gitlab:permissions:validate

bundle exec rspec \
  spec/requests/api/graphql/mutations/work_items/bulk_move_spec.rb \
  ee/spec/requests/api/graphql/mutations/work_items/bulk_move_spec.rb \
  ee/spec/requests/api/graphql/mutations/ci/project_subscriptions/create_spec.rb \
  ee/spec/requests/api/graphql/mutations/work_items/types/update_spec.rb

bundle exec rake gitlab:permissions:graphql:compile_docs gitlab:permissions:routes:compile_docs

Changelog: changed is on the commit, since token behaviour changes on a GA feature.