Stop splitting milestone titles on commas in work items REST API

What does this MR do and why?

Stop splitting milestone titles on commas in work items REST API

Milestone titles can contain commas, so splitting the milestone_title filter on commas turned a title like "September 16, 2026" into two titles that match nothing.

Passing several milestone titles as one comma-separated value (milestone_title=a,b) no longer works. Send them as an array instead (milestone_title[]=a&milestone_title[]=b), which is what the work items list UI already does when you add more than one Milestone token. Blank values are still ignored and surrounding whitespace is still trimmed.

References

• #629214 (closed)

Screenshots or screen recordings

Not provided

How to set up and validate locally

1. Enable the work_item_rest_api and work_item_rest_api_frontend_users feature flags

2. In the same Rails console, create a milestone with a comma in its title and assign it to an open work item. Note the project ID and work item ID it prints, since the curl calls below use them.

   project = Project.find_by_full_path('flightjs/Flight')
   milestone = project.milestones.create!(title: 'September 16, 2026')
   issue = project.issues.opened.first
   issue.update!(milestone: milestone)
   [project.id, issue.id]

3. Open http://127.0.0.1:3000/flightjs/Flight/-/work_items, filter by State Open and Milestone September 16, 2026, and confirm the assigned work item shows up.

4. Call the REST endpoint with a personal access token that has the read_api scope, and confirm it returns only the assigned work item ID:

   curl --globoff --header "PRIVATE-TOKEN: <your_access_token>" \
     --url "http://127.0.0.1:3000/api/v4/projects/<project_id>/-/work_items?state=opened&milestone_title[]=September%2016%2C%202026" \
     | jq 'map(.id)'

5. Call the negated filter and confirm the work item is excluded (the command prints false):

   curl --globoff --header "PRIVATE-TOKEN: <your_access_token>" \
     --url "http://127.0.0.1:3000/api/v4/projects/<project_id>/-/work_items?state=opened&per_page=100&not[milestone_title][]=September%2016%2C%202026" \
     | jq 'map(.id) | index(<work_item_id>) != null'

6. Optional: check out master and repeat steps 3 to 5 to see the bug. The UI shows "No results found", the first curl call returns [], and the negated call prints true because the work item is not excluded.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.