Require a permission for each resource of a fine-grained token

What does this MR do and why?

The fine-grained token form checked only that some permission was selected somewhere. A resource selected without a permission adds nothing to the token, so the form dropped it: a new token kept only the resources that had a permission, and a copy with resources added without permissions came out unchanged.

The permissions selector now reports each selected resource that has no permission selected in its own boundary, and the form refuses to create the token while there is one. The error under the selector names those resources ("Select permissions for this resource or remove it: Group."). New and duplicated tokens go through the same check. The documentation already asks for this: "In the right panel, select an available permission for each resource" (docs).

A resource left without permissions by Add permissions with Duo is refused the same way. The select-all feature spec now expects the refusal and removes the resources without permissions first. The group OAuth application picker uses the selector without the new event and does not change.

Checks I ran

• jest --runTestsByPath (Node 22.23.1) on master's code with the two changed specs: 112 tests, 12 failures, all of them assertions (the token mutation called, the error empty or the old generic message, no incomplete-resources-change event).
• On this branch: the 38 suites under spec/frontend/vue_shared/access_tokens/, spec/frontend/personal_access_tokens/, ee/spec/frontend/personal_access_tokens/ and spec/frontend/oauth_application/ pass (798 tests), and the two changed specs pass with VUE_VERSION=3 as well. They include the five suites jest --findRelatedTests selects for the two changed components.
• ESLint and Prettier on the changed files, RuboCop on the feature spec, tooling/bin/gettext_extractor locale/gitlab.pot (adds only the new string), the commit linter and Danger's commit and title linters pass.
• Left to the pipeline: the :js feature spec spec/features/user_settings/granular_personal_access_tokens/token_creation_spec.rb.

References

Closes #627729

Screenshots or screen recordings

Before	After

Before: the issue's recording of its second case. After: the form mounted in Jest and drawn in Chrome with the application CSS (not a running GitLab), after Generate token with Group given no permission.

How to set up and validate locally

1. Go to /-/user_settings/personal_access_tokens/granular/new.
2. Fill in the name and description and select All groups and projects I have access to.
3. In the Groups category, select Avatar and Group. Give Avatar the Read permission and leave Group without one.
4. Select Generate token. On master the token is created with Avatar only; on this branch it is not, and the error names Group.
5. Remove Group, or give it a permission, and select Generate token again: the token is created.
6. Duplicate a fine-grained token, add a resource without a permission and select Generate token: master creates an unchanged copy; this branch names the new resource.

I did not follow these steps in a running GitLab. Two new Jest specs in create_granular_personal_access_token_form_spec.js cover steps 3, 4 and 6 with the real selector and fail on master.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.