Point to the opt-in criteria when the anonymous comparison fails

What does this MR do?

Adds one paragraph to the REST guide for fine-grained tokens, after the example of a second invocation on a public project. When the comparison fails because only the anonymous request succeeds, it says to check the opt-in criteria in "Allowing Access on Publicly Visible Resources" before adding the permission to public_anonymous.yml, and to raise a permission that does not meet them with the reviewer. The role also grants its permissions to anonymous users: ProjectPolicy enables them under rule { public_project } and GroupPolicy under rule { public_group }.

This MR first also changed when to add the second invocation, because the shared example compared against a legacy non-member. Since !269281 (merged) the comparison is with an anonymous request, so the guide's condition (anonymous users can reach the GET endpoint) is right as it is. I dropped my change and rebased onto master. The comparison now also fails on a response that leaks the member view, where adding a permission is not the fix, so the paragraph names the case it is about.

The distilled permissions-rest-gpat.md follows in its next sync.

Related issues

Follows my note at !267340 (comment 4149067496), reworked after !269281 (merged).

Author's checklist

• Followed the documentation process, guidelines and Style Guide. No new page.

Reviewer's checklist

• Reviewed by a subject matter expert. doc/development/ needs no technical writer.