Return quickActionsStatus to fine-grained tokens in note mutations

What does this MR do and why?

The ten note mutations built on Mutations::Notes::Base (createNote, updateNote, destroyNote and others) return quickActionsStatus, of type QuickActionsStatus, which has no authorize_granular_token directive. Fine-grained personal access tokens are denied every such type, so a token holding create_note gets quickActionsStatus: null from createNote although the quick actions ran. A legacy token gets the status.

Every note mutation already authorizes the token with create_note, update_note or delete_note, and no other field returns the type. This MR gives it skip_reason: :parent_authorizes, like QuickActionCommand, and removes it from config/authz/graphql/authorization_todo.txt. A permission directive would need a boundary, and the object is a hash built from the mutation's result, with no project or group to take one from. The token only sees the status of the quick actions it just ran.

No new permission or assignable permission. Skipped types are not listed in the fine-grained token documentation, so it does not change.

References

• Related to #593878, the remaining GraphQL gaps for fine-grained tokens.
• !251840 (merged) gave WorkItemStatus, WorkItemType, WorkItemFeatures and NamespaceAvailableFeatures the same annotation.

I found this while working on gitlab-mcp-server.

Screenshots or screen recordings

Not applicable: no UI change.

How to set up and validate locally

1. Create a fine-grained personal access token for a project where you are a Developer, with the Work Item: Create permission (it holds create_note).

2. Comment on a merge request of that project with a quick action:

   curl --request POST --header "Authorization: Bearer <your_token>" --header "Content-Type: application/json" \
     --data '{"query": "mutation { createNote(input: {noteableId: \"gid://gitlab/MergeRequest/<id>\", body: \"a note\\n/internal_note\"}) { errors quickActionsStatus { commandNames commandsOnly messages } } }"}' \
     --url "http://gdk.test:3000/api/graphql"

3. On master quickActionsStatus is null. On this branch it is {"commandNames": ["internal_note"], "commandsOnly": false, "messages": ["Made this comment an internal note."]}.

Checks I ran (Ruby 3.3.11)

• With master's QuickActionsStatusType and todo list, spec/requests/api/graphql/mutations/notes/create/note_spec.rb gives 60 examples, 1 failure: the new one, where quickActionsStatus is nil and errors is empty.
• On this branch, that file with the updateNote and EE createNote request specs: 105 examples, 0 failures.
• bundle exec rake gitlab:permissions:validate: GraphQL permissions are valid, and the fine-grained token documentation is up to date.
• RuboCop on the two Ruby files: no offenses. The commit linter: no findings.
• Left to the pipeline: Ruby 3.4.10.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.