Add setting to require authentication for the CI Lint API

What does this MR do and why?

Unauthenticated users can call GET /projects/:id/ci/lint on any public project. The UI doesn't allow this: unauthenticated users can't open the pipeline editor.

This MR:

• Adds the ci_lint_api_require_authentication application setting (Admin > Settings > CI/CD > Continuous Integration and Deployment, and the settings API). Disabled by default. When enabled, unauthenticated GET requests get 401 Unauthorized.
• Adds the ci_lint_allow_unauthenticated_override ops flag, checked against the project's root namespace, to keep unauthenticated access for namespaces that still depend on it. Same pattern as ci_pipeline_variable_limits_override and ci_pipeline_seed_timeout_override.
• Keeps 404 for unauthenticated requests to private or missing projects, also when the setting is enabled. The new check runs after authorize_read_code!, and a spec covers this case.
• Updates the API docs, the admin docs, and the OpenAPI spec.

Because the setting is disabled by default, existing instances are not affected. Enabling it on GitLab.com is a separate step, tracked in #638411: we enable the override for the namespaces that use the endpoint without authentication today, then enable the setting.

Note: this endpoint does not accept CI/CD job tokens, so requests with CI_JOB_TOKEN are treated as unauthenticated today. When the setting is enabled, they get 401. This is documented in the API and admin docs. Accepting job tokens on this endpoint is out of scope for this MR.

References

• #638411

Screenshots or screen recordings

The new checkbox in Admin > Settings > CI/CD > Continuous Integration and Deployment: Require authentication for the CI Lint API.

How to set up and validate locally

1. Pick a public project with a .gitlab-ci.yml, for example gitlab-org/gitlab-test, and note its ID.

2. Call the endpoint without a token. It returns 200:

   curl --include "http://gdk.test:3000/api/v4/projects/<project_id>/ci/lint"

3. Go to Admin > Settings > CI/CD > Continuous Integration and Deployment, select Require authentication for the CI Lint API, and save.

4. Call the endpoint again without a token. It returns 401 with This endpoint requires an API authentication. With a personal access token, it returns 200.

5. In the Rails console, enable the override for the project's root namespace:

   Feature.enable(:ci_lint_allow_unauthenticated_override, Project.find(<project_id>).root_namespace)

6. Call the endpoint without a token. It returns 200 again.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.