Allow ai_workflows scope to download uploads by secret

What does this MR do and why?

Duo Agent Platform sessions couldn't read files attached to issues and work items. Their composite-identity token is limited to the ai_workflows scope, and API::MarkdownUploads only allowed that scope for POST. Downloads returned 403 insufficient_scope.

This MR allows ai_workflows on the download-by-secret routes (GET and the HEAD Grape generates from it):

• GET /projects/:id/uploads/:secret/:filename
• GET /groups/:id/uploads/:secret/:filename

These routes only need Guest access (read_upload), and the caller must already know the secret from the markdown link. The permission check still applies, so a user without access gets a 404.

Each route opts in with route_setting :ai_workflows_download, true, the same approach the mcp scope uses in lib/api/concerns/mcp_access.rb. Access follows the route definition rather than the URL shape, so other routes can't pick up the scope by accident.

The scope stays blocked for listing (GET /uploads), download by ID (GET /uploads/:upload_id) and all DELETE routes. Listing and download by ID are Maintainer-only because they let a caller enumerate uploads.

Why this is the missing scope

Duo Developer reported: "Downloading the upload returned a 403: my token lacks the scope" when it tried to read a CSV attached to a test-failure work item. The api and read_api scopes aren't available to composite-identity tokens, which only have ai_workflows and mcp. So the upload download endpoint was unreachable for agents.

References

• https://gitlab.com/gitlab-org/quality/test-failure-issues/-/work_items/44607#note_3928313320

Screenshots or screen recordings

Not applicable: API-only change.

How to set up and validate locally

1. Attach a file to an issue in a project you have Guest access to, and note the /uploads/<secret>/<filename> part of the link.
2. Trigger Duo Developer on the issue with the guidance to read the file and return its contents to you
3. See it return the contents.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.