Add a cop that flags manual granular token checks in GraphQL

What does this MR do and why?

The GraphQL permissions docs and gitlab:permissions:validate read granular token requirements only from authorize_granular_token directives. A check made by calling Authz::Tokens::AuthorizeGranularScopesService in a resolver is invisible to both, so the docs miss the requirement and a token built from them is denied at runtime.

No resolver or mutation calls the service any more. This adds Gitlab/Authz/UseGranularTokenDirective, which flags the service under app/graphql and ee/app/graphql, so a new requirement goes on a directive instead.

• It reports no offenses on master, so there is no todo file.
• The framework's own call, in lib/gitlab/graphql/authz/granular_scope_authorization.rb, is outside those directories, and so is every other caller, such as the REST API helpers and Gitlab::GitAccess.
• No changelog trailer: this only changes developer tooling.

References

Closes #627165 (closed)

Screenshots or screen recordings

Not applicable: no UI change.

How to set up and validate locally

1. Add ::Authz::Tokens::AuthorizeGranularScopesService.new to any file under app/graphql/.
2. Run bundle exec rubocop --only Gitlab/Authz/UseGranularTokenDirective on that file: it reports the offense.
3. The same line in a file under app/services/ reports nothing.

What I ran

• The cop spec passes (6 examples). It fails against three broken versions of the cop: one that reports nothing, one that ignores the Authz::Tokens namespace, and one that matches only the form with a leading ::.
• bundle exec rubocop --only Gitlab/Authz/UseGranularTokenDirective app/graphql ee/app/graphql: no offenses.
• RuboCop on the changed files: no offenses.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.