Draft: Remove legacy group audit streaming GraphQL APIs

What changes for users

• The group-level legacy audit event streaming GraphQL APIs deprecated in 18.10 are removed: 16 mutations and 3 Group fields. Clients still calling them must move to the new API.
• Instance-level legacy APIs stay until 20.0 and are unchanged.

Why

The legacy group APIs have a replacement on the new API and the GitLab UI already uses it, so keeping them only adds more surface to guard. Removal was announced for 20.0.

Status

• Stacked on !267270 "Cap audit streaming destinations and rate limit their mutations". This MR targets its branch until that merges, then gets retargeted to master.
• Removal milestone is 20.0 as announced. It can merge earlier only if Product#14600 "Breaking change exception: Remove legacy group audit event streaming GraphQL APIs in 19.6 (instead of 20.0)" is approved. In that case this MR also updates removal_milestone in the deprecation entry.

The change

• Removal, no flag. Deletes the 16 legacy group mutations and 3 legacy Group fields (externalAuditEventDestinations, googleCloudLoggingConfigurations, amazonS3Configurations), their mutation and type classes, the 19 unused group legacy frontend .graphql files and their specs, the unused group header services (ee/app/services/audit_events/streaming/headers/) and two leftover .graphql fragments on the deleted types.
• Replacements. The full mapping is in data/deprecations/18-10-legacy-group-audit-event-streaming-graphql-apis.yml.
• Rate limit guard. Deletes the rate limit that !267270 (merged) adds to the 6 legacy group create and update mutations, since they no longer exist.
• Docs. doc/api/graphql/audit_event_streaming_groups.md becomes a redirect to the audit event streaming user doc. Two links in that doc now point to the new mutations. The GraphQL reference, introspection and possible types are regenerated.
• Unchanged. Legacy models, tables and the new-to-legacy sync. Code shared with the instance-level legacy APIs.
• Rollback. By revert only.

Customer impact

The removal is a breaking change for any client still calling the legacy mutations. Seven days of logs show at most about 13 calls a day (legacy HTTP create) and 3 (legacy GCP). These counts are upper bounds. Those callers must move to the new API.

How to validate

In a Rails console, as an owner of a top-level Ultimate group named toolbox. Run on master (or !267270 (merged)) and on this branch. Both mutations run in one rolled-back transaction:

root = User.find_by_username('root')
legacy = 'mutation { externalAuditEventDestinationCreate(input: { groupPath: "toolbox", destinationUrl: "https://example.com/removal-check" }) { errors } }'
replacement = 'mutation { groupAuditEventStreamingDestinationsCreate(input: { groupPath: "toolbox", name: "removal-check", category: "http", config: { url: "https://example.com/removal-check-new" } }) { errors } }'
ApplicationRecord.transaction do
  h = GitlabSchema.execute(legacy, context: { current_user: root }).to_h
  puts "legacy: #{(h['errors'] || [h.dig('data', 'externalAuditEventDestinationCreate', 'errors')]).inspect}"
  h = GitlabSchema.execute(replacement, context: { current_user: root }).to_h
  puts "replacement: #{(h['errors'] || [h.dig('data', 'groupAuditEventStreamingDestinationsCreate', 'errors')]).inspect}"
  raise ActiveRecord::Rollback
end

Check	master / !267270 (merged)	This branch
externalAuditEventDestinationCreate (legacy)	errors: []	"Field 'externalAuditEventDestinationCreate' doesn't exist on type 'Mutation'"
groupAuditEventStreamingDestinationsCreate (replacement)	errors: []	errors: []

Related to #636584 "Audit streaming destination mutations (caps, limits, length validation)"