Remove read_branch_rule from the auditor role

What does this MR do and why?

Remove read_branch_rule from the auditor role.

The auditor docs say auditors "Cannot access group or project settings." Branch rules are a repository setting, so auditors shouldn't be able to reach the branch rules settings page. This MR removes read_branch_rule from the project raw_permissions in config/authz/roles/auditor.yml and adds a changelog entry because this is a user-facing fix.

Details

How auditors got access

Two commits introduced this:

1. Commit 7c885619 (2026-03-27, "Use read_branch_rule permission in projects helper") added read_branch_rule to the auditor role and switched ProjectsHelper#can_view_branch_rules? to check it. Branch rules links started showing for auditors, but Projects::Settings::BranchRulesController still required admin_project so the page returned a 404.
2. Commit 72cd14d4 (2026-04-13, "Use read_branch_rule to authorize branch rules controller") switched the controller to authorize_read_branch_rule!. From then on auditors could open the page.

Auditors could load the page shell but they saw no rules. Types::Projects::BranchRuleType has authorize :read_protected_branch, and auditors only hold read_protected_branch at the group level, not on projects. So every rule was filtered out.

Spec changes

• New request spec ee/spec/requests/projects/settings/branch_rules_controller_spec.rb checks that an auditor gets a 404 on the branch rules settings page.
• The BranchRulePolicy, AllBranchesRulePolicy and AllProtectedBranchesRulePolicy specs each get an "as an auditor" context that uses the disallows branch rule crud shared example. These catch the regression because holding read_branch_rule on a role also grants _read_protected_branch_rule and _read_custom_branch_rule through the conditionally_enables: expansion in lib/authz/role.rb, and those policies check them.
• ee/spec/policies/project_policy_spec.rb adds read_branch_rule to the auditor excluded_permissions list in the "for read_* permissions" context. Before this MR that list was only skipped by expect_allowed and nothing asserted those permissions were disallowed. A new disallows the excluded permissions example now asserts that.

I verified locally that re-adding read_branch_rule to the auditor role makes the request spec (200 instead of 404), the new project policy example, and all three branch rule policy auditor contexts fail.

References

Related to !249249 (comment 3894297869)

How to set up and validate locally

1. Run the specs

bundle exec rspec ee/spec/requests/projects/settings/branch_rules_controller_spec.rb
bundle exec rspec ee/spec/policies/ee/projects/branch_rule_policy_spec.rb ee/spec/policies/ee/projects/all_branches_rule_policy_spec.rb ee/spec/policies/projects/all_protected_branches_rule_policy_spec.rb
bundle exec rspec ee/spec/policies/project_policy_spec.rb -e auditor

Expected: All examples pass.

2. Check the branch rules page as an auditor

1. Sign in as an auditor user.
2. Visit a project's Settings > Repository > Branch rules page (/<project>/-/settings/repository/branch_rules).

Expected: The page returns a 404.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.