Subscribe scan profile worker to archival events

What does this MR do and why?

This MR registers Security::ScanProfiles::ProcessArchivedEventsWorker as a subscriber in ee/lib/gitlab/event_store/subscriptions/security_subscriptions.rb, subscribing it to both ::Projects::ProjectArchivedEvent and ::Namespaces::Groups::GroupArchivedEvent — the same shape as Vulnerabilities::ProcessTransferEventsWorker in vulnerabilities_subscriptions.rb.

The worker class already shipped in Exclude archived projects from scan profile pro... (!258255 - merged) • rossfuhrman • 19.5, but deliberately without a subscription: registering the subscription in the same release as the worker would let the event store enqueue jobs for a class that Sidekiq nodes still running the previous revision can't load, which breaks GitLab's multi-version compatibility guidance. Now that the worker class is deployed everywhere, it's safe to start enqueuing jobs for it. With the subscription in place, Security::ScanProfiles::ProcessArchivedEventsWorker regains the it_behaves_like 'subscribes to event' shared example — once in each event's context — which publishes the event and asserts the worker consumes it; it could only pass once the subscription existed, which is why it lives here rather than in the first MR.

This MR is no longer stacked: Exclude archived projects from scan profile pro... (!258255 - merged) • rossfuhrman • 19.5 has merged and is on master, and this branch is rebased down to a single commit. The diff is now just this MR's own change: the store.subscribe pair in ee/lib/gitlab/event_store/subscriptions/security_subscriptions.rb, plus two it_behaves_like 'subscribes to event' lines in the worker spec, 8 lines across 2 files.

No changelog trailer here — the changelog entry for this change already lives on Exclude archived projects from scan profile pro... (!258255 - merged) • rossfuhrman • 19.5; this MR is just wiring.

Related issue

Exclude archived projects from security scan pr... (#629984) • rossfuhrman • 19.6

How to set up and validate locally

Both steps need the enqueued jobs to actually run, so either keep GDK's Sidekiq running or wrap the call in Sidekiq::Testing.inline! from rails console -e test.

1. Archive a project that has a scan profile attached and confirm its join rows flip without calling the service directly — the subscriber does it:

   user    = User.find_by_username('root')
   project = Project.find(<project_id>) # one with an attached scan profile
   
   Projects::ArchiveService.new(project: project, current_user: user).execute
   
   Security::ScanProfileProject.by_project_id(project.id).pluck(:archived)
   # => [true]

2. Archive a parent group and confirm the cascade reaches descendant projects:

   group = Group.find(<group_id>)
   
   Namespaces::Groups::ArchiveService.new(group, user).execute
   
   group.all_projects.find_each do |p|
     puts [p.full_path, Security::ScanProfileProject.by_project_id(p.id).pluck(:archived)].inspect
   end
   # => every project with an attached scan profile reports [true]

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code