Move service account token rotation specs into a shared example

What does this MR do and why?

This follows !260929 (merged), as eduardosanz asked in its review.

!260929 (merged) added the same three examples to the rotate block of spec/requests/api/group_service_accounts_spec.rb and of spec/requests/api/project_service_accounts_spec.rb, because both routes rotate through PersonalAccessTokens::RotateService and present the new token the same way:

• A token that is not granular is presented without granular_scopes, and presenting it runs no query on granular scopes.
• A granular token with a project scope is presented with that scope and the project's project_id.
• A new token with two scopes is presented with no more queries than one with one.

This MR moves them, line for line, into one shared example, service account token rotation presenting granular scopes, and both rotate blocks now include it. The one thing the two copies did differently was where the projects the granular tokens are scoped to come from, so each spec still defines them: the group spec creates both in its group, and the project spec uses the service account's own project and creates the other one. Nothing else changes, neither in the application code nor in what the examples assert.

References

Related to #632896 (closed)

• !260929 (merged), which this follows.
• The same three examples, set up differently, are also in the rotate specs !260276 (merged) added for POST /personal_access_tokens/self/rotate (spec/requests/api/personal_access_tokens/self_rotation_spec.rb) and for the GitLab.com route that rotates an enterprise user's token (ee/spec/requests/api/manage/groups_spec.rb). There the token belongs to the caller or to an enterprise user rather than to a service account, and each request authenticates in its own way, so sharing them would mean passing the token's owner and the request into the example. I kept this MR to the two files !260929 (merged) touched, and can widen the shared example to those two in another MR if you think it is worth it.

What changed, file by file

• spec/support/shared_examples/requests/api/service_account_token_rotation_shared_examples.rb (new): the three examples, with the helpers the N+1 example uses, as they were in each spec. A comment at the top lists what the including spec defines: admin, service_account_user, base_path, token, project and other_project. It sits under spec/support/shared_examples/requests/api/, beside the other request shared examples, so that both spec files load it without requiring each other: the testing guide asks not to define a shared example in one spec file and use it from another.
• spec/requests/api/group_service_accounts_spec.rb and spec/requests/api/project_service_accounts_spec.rb: the rotate block includes the shared example in place of the examples, and defines the projects it needs.

Tests

I ran the specs locally (Ruby 3.3.11, PostgreSQL 17) on this change on top of the last commit of !260929 (merged), and again after rebasing it onto master once !260929 (merged) merged. The rebase changed nothing in the rotate blocks: the only other change master made to the two files in the meantime adds external to the keys two other examples in each file expect.

• The rotate examples of both spec files, with the command under "How to set up and validate locally": 16 examples, 0 failures, 2 pending, before and after the rebase, the same 16 examples !260929 (merged) ran. The pending ones are the granular token authorization shared examples excusing themselves, as there.
• Both spec files in full, before and after the rebase: 171 examples, 0 failures, 18 pending, the same counts as the two files give without this change (as !260929 (merged) left them, and as master holds them after the rebase).
• With both routes presenting the new token without granular_scopes_options_for, as before !260929 (merged), and before the rebase: the four examples that read granular_scopes fail, two through each spec, so the shared example still runs on both routes.

rubocop reports no offenses on the three files, and scripts/lint/commit_linter.rb and the Danger commit linter of gitlab-dangerfiles 4.12.0 none on the commit message, before and after the rebase.

Screenshots or screen recordings

Not applicable, this changes specs only.

How to set up and validate locally

bundle exec rspec spec/requests/api/group_service_accounts_spec.rb spec/requests/api/project_service_accounts_spec.rb -e 'personal_access_tokens/:token_id/rotate'

MR acceptance checklist

• I have evaluated the MR acceptance checklist for this MR.
• Specs only: no application code, documentation or changelog entry changes.
• Specs run locally: 16 examples, 0 failures, 2 pending for the rotate examples of both routes, and 171 examples, 0 failures, 18 pending for both spec files in full, before and after the rebase; the same counts as without this change.