Document accepted tokens and 403 error for the GitLab MCP server

What does this MR do?

Documentation only. No code changes.

• mcp_server.md: adds an Authentication section that lists the tokens the GitLab MCP server accepts (OAuth tokens with the mcp scope, and fine-grained personal access tokens with the MCP tool resource and Execute permission). It also lists the tokens it rejects with 403 Forbidden (legacy personal access tokens, project access tokens, and group access tokens), even when they have api scope.
• mcp_server_troubleshooting.md: moves the note about the GitLab 19.4 and earlier 404 Not Found response below the causes list in the Error: 403 Forbidden section.

Source evidence

• lib/gitlab/auth.rb: unavailable_ai_features_scopes removes :mcp from the scopes offered to legacy personal access tokens and to project and group access tokens.
• lib/api/mcp/base.rb: the before block returns 403 unless the token includes the mcp or granular scope.
• Fine-grained PATs: the MCP routes set permissions: :execute_mcp_tool. doc/auth/tokens/fine_grained_access_tokens_rest.md already lists the MCP tool resource with Execute.
• REST-backed tools call the underlying API route in the same process, which also checks granular token scopes. A fine-grained token therefore also needs permissions for the resources the tool accesses. This comes from reading the code and was not reproduced. Reviewers: please confirm.

Related issues

• Proposed support for other token types: #586184

Author's checklist

• Follow the:
  • Documentation process.
  • Documentation guidelines.
  • Style Guide.
• If you're adding a new page, add the product availability details under the H1 topic title. Does not apply: no new page.
• If you are a GitLab team member, request a review based on:
  • The documentation page's metadata.
  • The associated Technical Writer.

Vale, markdownlint and the docs link check passed locally in the pre-commit hooks.

Reviewer's checklist

Documentation-related MRs should be reviewed by a Technical Writer for a non-blocking review, based on Documentation Guidelines and the Style Guide.

• If the content requires it, ensure the information is reviewed by a subject matter expert.
• Technical writer review items:
  • Ensure docs metadata is present and up-to-date.
  • Ensure the appropriate labels are added to this MR.
  • Ensure a release milestone is set.
  • If relevant to this MR, ensure content topic type principles are in use.
• Review by assigned maintainer, who can always request/require the reviews above.