Route ML model and experiment web deletion through services

What does this MR do and why?

Deleting an ML model or experiment from the web UI now goes through the same destroy services as the API and GraphQL. Before, Projects::Ml::ModelsController#destroy destroyed the record directly, so the model's packages were not marked for destruction and no audit event was recorded. Projects::Ml::ExperimentsController#destroy also showed "Experiment removed" when the deletion was refused.

Context for reviewers and agents

• Projects::Ml::ModelsController#destroy now calls Ml::DestroyModelService and Projects::Ml::ExperimentsController#destroy calls Ml::DestroyExperimentService. Both redirect to the list as before, with the success notice or the service error as an alert.
• The model action now needs the permissions that Ml::DestroyModelService checks: when the model has packages, Packages::MarkPackagesForDestructionService needs destroy_package. The frontend does not call DELETE /-/ml/models/:model_id (it deletes models through the mlModelDelete mutation, which already uses the service), so this changes behaviour only for direct calls to that route.
• Experiment deletion keeps the runs' packages, as the MLflow API does today.
• No feature flag: this is a bug fix with the same behaviour as the API and GraphQL paths. Rollback: revert.
• The experiment controller spec checks that the experiment is no longer found (Ml::Experiment.by_project_id_and_iid), not that the row is gone, so it also holds once !263939 hides experiments instead of deleting them in the request.
• Follow-ups for https://gitlab.com/gitlab-org/gitlab/-/work_items/635051: remove the unused DELETE /-/ml/models/:model_id route, or document that experiment deletion keeps run packages.

Related MRs (all from https://gitlab.com/gitlab-org/gitlab/-/work_items/635041):

1. This MR (independent, targets master).
2. !264622 adds the background deletion worker (independent, targets master).
3. !263939 marks experiments for deletion behind a feature flag; it is stacked on the worker MR and merges last.

This MR and the worker MR can merge in either order.

References

• Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/635051
• Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/635041

Screenshots or screen recordings

No visual change. When an experiment deletion is refused, the experiment list now shows the error instead of "Experiment removed".

How to set up and validate locally

1. Create a model with a version and a package, for example by uploading a model version through the MLflow client, in gitlab-org/gitlab-test.
2. In a terminal, call the web route with a session cookie and CSRF token from the browser: DELETE http://gdk.test:3000/gitlab-org/gitlab-test/-/ml/models/<model_id>.
3. Expect: the model is deleted, its package shows as pending destruction in Deploy > Package registry, and an ml_model_destroyed audit event exists.
4. Open an experiment that belongs to a model ([model]<name>) at http://gdk.test:3000/gitlab-org/gitlab-test/-/ml/experiments and select More actions > Delete experiment.
5. Expect: the list shows "Cannot delete an experiment associated to a model" and the experiment is still there. On master it shows "Experiment removed".

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.