Fix custom role approvers lookup without container

What does this MR do and why?

Fixes the admin page Admin area > Settings > Roles and permissions on GitLab Self-Managed. Since 19.4, it shows "Failed to fetch roles" and lists no roles.

When does it happen? An instance-level custom role is used as an approver (role_approvers) in an approval policy.

Why does it break? !252128 (merged) added an organization filter when looking up custom role approvers. The filter reads the organization from the role's group. Instance-level roles have no group, so the lookup crashes with NoMethodError: undefined method 'organization_id' for nil.

The fix: Apply the organization filter only when a group or project is available. Without one, look up the instance-level roles directly, as before 19.4. The same MR already has this check in ApprovalGroupsFinder. It was missing in FetchPolicyApproversService.

Affected versions: 19.4 and 19.5. A backport might be needed.

Not affected: Policy enforcement on projects and groups, and group-level role pages. In those cases a group or project is always available.

References

• Issue: #630858 (closed)
• Introduced by: !252128 (merged)

Screenshots or screen recordings

Not applicable. This is a backend fix. The page shows the roles again instead of the error.

How to set up and validate locally

1. Use a Self-Managed instance with an Ultimate license.

2. Create an instance-level custom role.

3. Create an approval policy that uses the role's numeric ID in role_approvers.

4. Open /admin/application_settings/roles_and_permissions. Before this fix, it shows "Failed to fetch roles". After this fix, the roles are listed.

5. Optional, in a Rails console:

   u = User.find_by_username('<admin>')
   q = "query { memberRoles { nodes { id name dependentSecurityPolicies { id name } } } }"
   pp GitlabSchema.execute(q, context: { current_user: u }).to_h

   Before this fix, the result contains the organization_id error. After this fix, it returns data.

Specs:

• ee/spec/services/security/security_orchestration_policies/fetch_policy_approvers_service_spec.rb: new case with no container
• ee/spec/requests/api/graphql/member_role/dependent_security_policies_spec.rb: new case with an instance-level role as approver

Without the fix, the new examples fail with the error above. With the fix, all examples pass.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.