Stop security widget spinning on blocked pipelines

What does this MR do and why?

Stop security widget spinning on blocked pipelines

When a merge request pipeline is blocked on a manual job with allow_failure: false, any job that needs: that manual job stays in "created". If one of those jobs produces a security or CycloneDX report, the backend correctly reports the scans as not ready, because the results really are still pending. The widget keeps polling while scans are not ready, so it showed "Security scanning is loading" with a spinner forever. Now, when the head pipeline is blocked and the scans are not ready, the widget stops polling and shows "Security scans not completed. The pipeline is waiting for a manual action." Polling resumes once the pipeline is no longer blocked, for example after someone plays the manual job. This is a frontend-only change. An earlier version changed the backend readiness check, but that was dropped because ready: false is correct and the check also gates approval policy evaluation.

Known limitation: if the target branch pipeline is the blocked one, the widget can still spin. That is being discussed with the reviewer as a follow-up.

Resolves #580889

Changelog: fixed EE: true

References

• #580889
• Review discussion that moved the fix to the frontend: !259300 (comment 3956611527)

Screenshots or screen recordings

Before (master): the widget spins for as long as the page is open. After (this MR): the widget says the scans have not completed, then loads the results once the deploy job is played and the pipeline finishes.

Before	After

How to set up and validate locally

1. Use a GitLab instance with an Ultimate license and create a new project.

2. Commit this .gitlab-ci.yml to the default branch:

   stages:
     - test
     - deploy
     - post-deploy
   
   secret_detection:
     stage: test
     script:
       - echo '{"version":"15.2.1","vulnerabilities":[],"scan":{"analyzer":{"id":"secrets","name":"secrets","version":"7.0.0","vendor":{"name":"GitLab"}},"scanner":{"id":"gitleaks","name":"Gitleaks","version":"8.21.0","vendor":{"name":"GitLab"}},"type":"secret_detection","start_time":"2026-10-02T10:00:00","end_time":"2026-10-02T10:00:05","status":"success"}}' > gl-secret-detection-report.json
     artifacts:
       reports:
         secret_detection: gl-secret-detection-report.json
   
   deploy:
     stage: deploy
     script: echo "deploying"
     when: manual
     allow_failure: false
   
   sbom:
     stage: post-deploy
     needs: [deploy]
     script:
       - echo '{"bomFormat":"CycloneDX","specVersion":"1.4","version":1,"components":[]}' > gl-sbom.cdx.json
     artifacts:
       reports:
         cyclonedx: gl-sbom.cdx.json

3. In the default branch pipeline, play the deploy job and let the pipeline finish.

4. Create a branch, commit any change (for example, add a file leak.txt), and open a merge request.

5. Wait for the merge request pipeline to become blocked on deploy. Do not play it.

6. Open the merge request. The security widget should show "Security scans not completed. The pipeline is waiting for a manual action." with no spinner.

7. Play deploy in the merge request pipeline. Once the pipeline finishes, the widget should load the security results.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #580889