Add ai_workflows scope to job artifacts and deployments GET endpoints

What does this MR do and why?

Lets an ai_workflows OAuth token read job artifacts and deployments over REST. API::Ci::JobArtifacts and API::Deployments now carry the same read-only allow_access_with_scope :ai_workflows line as API::Ci::Jobs and API::Ci::Pipelines, so GET/HEAD on every route in those two classes is allowed for the scope. POST/PUT/DELETE in the same classes (POST .../artifacts/keep, both artifact DELETEs, deployment create/update/delete, and the EE deployment approval POST) keep returning 403 insufficient_scope, and each of those is pinned by a request spec so a later change cannot widen the grant silently.

This is item 3 of https://gitlab.com/gitlab-org/gitlab/-/work_items/630767#note_3905169447 (approved by @bastirehm): the read-only gaps that already had open issues. The GraphQL side of deployments and artifacts, and the incident timeline events half of #630640, are not addressed here. The scope grant gates the request only; the existing authorize_download_artifacts! / read_deployment policies and composite identity still gate the data, so this exposes nothing the token holder's human could not already read with an api or read_api token.

Also lists the Job Artifacts and Deployments APIs next to CI Jobs in doc/user/duo_agent_platform/flows/foundational_flows/software_development.md.

Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/630767 Related to #599661 Related to #630640

References

• https://gitlab.com/gitlab-org/gitlab/-/work_items/630767 (umbrella; approving note https://gitlab.com/gitlab-org/gitlab/-/work_items/630767#note_3905169447)
• #599661 (job artifacts)
• #630640 (deployments; REST half)
• Prior art: !256726 (merged) (same per-verb pin discipline for the work-item write paths)

How to set up and validate locally

Specs:

bin/rspec spec/requests/api/ci/job_artifacts_spec.rb spec/requests/api/deployments_spec.rb ee/spec/requests/api/deployments_spec.rb

Manual check against a private project:

1. Create an OAuth application and obtain a token with only the ai_workflows scope.
2. curl -sI -H "Authorization: Bearer $TOKEN" "$GITLAB/api/v4/projects/:id/jobs/:job_id/artifacts" returns 200 (was 403).
3. curl -s -H "Authorization: Bearer $TOKEN" "$GITLAB/api/v4/projects/:id/deployments" returns 200 (was 403).
4. curl -s -X POST -H "Authorization: Bearer $TOKEN" "$GITLAB/api/v4/projects/:id/jobs/:job_id/artifacts/keep" still returns 403 with "error":"insufficient_scope".
5. curl -s -X POST -H "Authorization: Bearer $TOKEN" "$GITLAB/api/v4/projects/:id/deployments" still returns 403 with "error":"insufficient_scope".

No feature flag; the grant is evaluated at class load like the existing jobs.rb / pipelines.rb grants. Revert is the single commit.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.