Require read_code to read ciConfigPathOrDefault in GraphQL

What does this MR do and why?

Aligns the permission check for the ciConfigPathOrDefault field on the GraphQL Project type with the REST API, which only exposes ci_config_path to users who can read_code.

Users without read_code now get an empty string. The field stays non-nullable, so this isn't a breaking schema change.

References

Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/632023

How to set up and validate locally

bin/rspec spec/graphql/types/project_type_spec.rb -e 'ci_config_path_or_default'

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.