Expose scan profile variables through GraphQL

What does this MR do and why?

Expose scan profile variables through GraphQL

Add Query.securityScanProfileVariables, which takes a scan type and
returns the configuration variables a scan profile of that type can
set: the setting key and its CI/CD variable. It backs the Add variable
modal in the scan profile UI.

Read the variables from the MAPPINGS in CiVariables so the list stays
in step with what the scan profile passes to the pipeline. Return an
empty list for scan types without a MAPPINGS entry.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/627250
Changelog: added
EE: true

References

• issues: Switch scan profile variable env-var mapping to... (#630693), Add human-friendly name field for security scan... (#627250)
• consumer Add advanced configuration variable modal and h... (!257354 - merged)
• related: Add Dependency Scanning configuration values an... (#629403)

Screenshots or screen recordings

Backend only. No UI change.

How to set up and validate locally

0. git checkout 627250-expose-scan-profile-variable-definitions-via-graphql

1. open the GraphQL explorer at /-/graphql-explorer and run this query:

   query {
     securityScanProfileVariables(scanType: SECRET_DETECTION) {
       key
       envVar
     }
   }

2. check that the response lists the secret detection variables:
   • every variable has a key and an envVar
   • excludedPaths has the envVar SECRET_DETECTION_EXCLUDED_PATHS
3. change scanType to SAST and check that the variables switch to the SAST ones such as SAST_EXCLUDED_ANALYZERS
4. change scanType to DEPENDENCY_SCANNING_POST_PROCESSING and check that securityScanProfileVariables is an empty list

to run tests

bundle exec rspec ee/spec/requests/api/graphql/security/scan_profile_variables_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.