Expose Observability provisioner settings in the settings API

What does this MR do and why?

Lets administrators set the GitLab Observability provisioner URL and API key with PUT /application/settings. Both settings are for GitLab.com only.

• o11y_provisioner_url is readable and writable.
• o11y_provisioner_api_key is write-only. GET /application/settings never returns it.
• If the admin settings form submits the key blank, the form keeps the existing value, the same as eks_secret_access_key.

This is the second of three MRs, stacked on the columns MR:

1. Columns and model: !262321 (merged)
2. Settings API (this MR)
3. Client reads the settings: !262323 (merged)

Implementation notes

• Both attributes are in visible_attributes, and have typed, length-limited params in lib/api/settings.rb.
• The key is removed from API::Entities::ApplicationSetting.exposed_attributes, like asset_proxy_secret_key and eks_secret_access_key. A request spec fails if the key shows up in the response.
• Logs: the param name ends in key, so config.filter_parameters already filters it.
• Audit events: encrypts attributes are in sensitive_attributes, which AuditEvents::Changes redacts.
• scripts/cells/application-settings-analysis.rb rejected string as the documented type for a jsonb column. An encrypts attribute stored in jsonb holds a string, so the script now accepts string for encrypted jsonb columns. Without this, ensure-application-settings-have-definition-file fails.
• OpenAPI v3 docs regenerated.

References

• Related issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/633458

Screenshots or screen recordings

Not applicable, API only.

How to set up and validate locally

1. Set both values as an administrator:

   curl --request PUT --header "PRIVATE-TOKEN: <admin_token>" \
     --url "http://gdk.test:3000/api/v4/application/settings" \
     --data "o11y_provisioner_url=https://provisioner.example.com/api/v1/provision_requests" \
     --data "o11y_provisioner_api_key=example"

2. Confirm the response includes o11y_provisioner_url but not o11y_provisioner_api_key.

3. Run GET /application/settings and confirm the same.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

A maintainer other than the author merges this MR, after the columns MR.