Report typed authorization errors in aggregation engine

Abhinaba Ghoshrequested to merge
629384-aggregation-typed-authorization-errors into master

What does this MR do and why?

Authorization validation errors on the aggregation model are now typed :unauthorized. When pruning unauthorized metrics leaves a request with no metrics at all, the engine reports "access to metric '' is not authorized" for each pruned metric, instead of the generic "at least one metric is required" that misled viewers whose real problem was authorization. Callers now have a stable way to distinguish authorization failures from other validation errors.

This deliberately changes the previously accepted behavior for the all-metrics-pruned case: the whole-connection hard error keeps its shape, only the message and error type change. doc/development/aggregation_engines.md is updated to match. Framework-only; first MR in a stack of three for the DAP Impact panel states.

References

How to set up and validate locally

  1. Run bin/rspec spec/lib/gitlab/database/aggregation.
  2. All 62 examples pass.

Screenshots or screen recordings

Backend only.

Merge request reports