Expose author bot status in merge request API responses

What does this MR do and why?

Adds a boolean author.bot field to merge request API responses so clients can identify bot authors without an additional request to the Users API.

Uses the existing User#bot? classification, including service accounts. A dedicated MergeRequestAuthor entity preserves the existing author fields and adds bot without changing the shared UserBasic entity.

The field is available in single merge request details and global, project, and group lists. The view=simple response remains unchanged.

Includes tests, response schema updates, API documentation, and regenerated OpenAPI definitions.

References

Closes #629789 (closed)

Screenshots or screen recordings

Not applicable: API response change with no UI changes.

Example author object after this change:

{
  "id": 123,
  "username": "automation-bot",
  "name": "Automation Bot",
  "bot": true
}

How to set up and validate locally

1. Start GDK and use a local access token with read_api scope.

2. Retrieve merge requests:

   curl --header "PRIVATE-TOKEN: <your_access_token>" \
     --url "http://127.0.0.1:3000/api/v4/merge_requests?scope=all" \
     | jq '.[] | {iid, author}'

3. Confirm author.bot is false for human accounts and true for bot accounts, including service accounts.

4. Retrieve an individual merge request and confirm the same field is present:

   curl --header "PRIVATE-TOKEN: <your_access_token>" \
     --url "http://127.0.0.1:3000/api/v4/projects/<project_id>/merge_requests/<mr_iid>" \
     | jq '.author'

Validation completed:

• Author and merge request entity specs: 8 examples passed.
• Response and query-count request specs: 2 examples passed.
• RuboCop, Vale, markdownlint, JSON lint, and OpenAPI consistency checks passed.

MR acceptance checklist

Evaluated against the MR acceptance checklist.

• Additive response field; existing fields and access controls are preserved.
• Reuses existing bot classification and preloaded author data.
• Query-count regression test passes.
• Tests, API documentation, and response schemas updated.
• No database migration required.
• Commit includes Changelog: added.