Hide branch protections from users who cannot read them

What does this MR do and why?

Hide the "Protect branch" section on the branch rule details page when the user can't read protected branches.

Before this change the "Protect branch" section was shown to anyone who could view a branch rule, as long as it wasn't one of the predefined rules ("All branches" / "All protected branches"). Users who can read branch rules but don't have read_protected_branch get no branch protection data from the GraphQL API, because BranchProtectionType authorizes read_protected_branch and branchProtection comes back null. The section still rendered, so "Allowed to merge" and "Allowed to push and merge" showed their empty states. That reads as if nobody can merge or push to the branch, which is wrong. No data leaks but the UI is misleading.

For example, a Guest with the manage_merge_request_settings custom role has read_branch_rule but not read_protected_branch. On a protected branch rule like main they saw the empty section.

branch_rules_data in the CE and EE helpers now includes can_read_protected_branches, based on can?(current_user, :read_protected_branch, project). The frontend provides it and hides the "Protect branch" section when it's false. This follows the existing pattern for approvals and status checks (show_approvers, show_status_checks).

The whole section is hidden together. Allowed to merge, allowed to push and merge, allow force push, and the EE code owner approval toggle all read from branch protection data these users can't see.

Why check against the project

Checking read_protected_branch on the project gives the same result as checking it on the protected branch. ProtectedBranchPolicy delegates to the project for project-level rules. Group-level rules don't render this section on the project page, they show the group-level empty state instead, so there's no group case to handle here.

References

• Related: Authorize branch rules on read_branch_rule (!249356 - merged)

How to set up and validate locally

The frontend is currently not accessible for manage_merge_request_settings users so running the specs and reviewing the code is all we can do. Once this is merged Authorize branch rules on read_branch_rule (!249356 - merged) will be reviewed showing the UI.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.