Add refresh button for merge request risk assessment

What does this MR do and why?

Currently, the risk assessment flow is triggered only when an MR is created and any changes after that are not re-evaluated.

This MR introduces a new button to refresh the assessment when the MR is stale. The button shows only when the flow is enabled for the project and the user can start CI-backed flows. Users who cannot, for example Reporters, see the warning without the button.

While a run updates the assessment, the summary keeps the previous headline and meter and adds "Updating…". The widget hides the stale warning, the Refresh button, the old details, and "View session". If a run fails, the summary reads "Risk assessment: Unavailable" and the meter is empty. It shows only the stale warning and the Refresh button, so the reader can try again.

References

• Issue: #609292 (closed)
• Epic: &23131 (closed)

Screenshots or screen recordings

Up-to-date MR

Stale MR

How to set up and validate locally

1. In a Rails console, enable the feature flags (this is the only console use for setup): Feature.enable(:duo_mr_risk_classification) and Feature.enable(:show_duo_mr_risk_classification_widget).
2. Turn on the Risk Classification flow for the top-level group and for gitlab-duo/test. Go to Settings > General > GitLab Duo > GitLab Duo features, and use Flow execution.
3. In http://gdk.test:3000/gitlab-duo/test, create a merge request in the UI. For example, edit a file in the web editor on a new branch, then create the merge request. Wait for the automatic assessment (about 15 to 30 seconds in GDK), then reload. The widget shows a score and "View session" in the header. Expand it. You see no stale warning and no Refresh button.
4. Push a new commit to the source branch of the merge request. For example, edit a file on that branch in the web editor. Reload the merge request and expand the widget. The stale warning shows at the bottom with a Refresh button beside it. A line above it separates it from the rationale and signals.
5. Keep the widget expanded and click Refresh. The summary keeps the score and adds "Updating…". The widget collapses and you cannot expand it. "View session" is hidden. No empty bordered strip stays under the summary.
6. Wait for the run to finish, then reload. The widget shows the new score and no stale warning. "View session" is back in the header.

Who sees the button

1. Sign in as a user with the Reporter role on gitlab-duo/test. Open a merge request with a stale assessment. The stale warning shows without the Refresh button.
2. Sign in as an Owner and turn off the Risk Classification flow for the project. Reload the same merge request. The stale warning shows without the Refresh button.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.