Disallow editing of project-level MR approval settings that are enabled at the instance level

What does this MR do?

This change effectively reinstates the instance-level MR approval settings effects on project-level ones. This was introduced before this issue but the behaviour subsequently has been evolved to just allow scoping of MR approval settings on compliance-labelled projects. As per feedback from one of our high-value customers, the current behaviour is not desirable as it breaks the global control on developer projects.

Timeline of this feature

• 2020-02-17: [12.8] Disable self-approval at the Instance level Issue <-- we would like to get back here
• 2020-04-24: [13.1] Instance-level MR approvals settings no longer affect project-level ones. Issue - MR
• 2020-05-20: [13.1] Revert maintainer permission lock-down MR
• 2020-06-19: [13.2] Allow admins to scope admin-level MR approval settings to compliance-labeled projects Issue - MR
• 2020-07-13: [13.2] GA scope admin-level MR approval settings MR
• 2020-10-21: [13.5] Fix the issue where modification of project-level MR approval rules is locked due to the instance-level MR approval settings. Issue, see Matt's comment about reverting this. MR <-- we are currently here

Before this MR

• Instance-level MR approval settings are scoped only to compliance-labelled projects.
• Project-level MR approval rules are not controlled by instance-level

After this MR

• Instance-level MR approval settings (once enabled) will
  • Disallow editing of project-level ones to any role
  • Project-level MR approval settings will reflect instance-level MR approval settings as SSOT
• Instance-level MR approval settings (once disabled) will
  • Allow editing of project-level ones to maintainer and above
  • Project-level MR approval settings will reflect project-level MR approval settings as SSOT
• Project-level MR approval rules is also controlled by instance-level

🎈 Breaking changes: 🎈 Instance-level MR approvals settings can no longer be scoped to compliance-labelled projects.

Note to maintainer: we would like to additionally pick this change to %13.5 as a new release patch.

Screenshots

Before (Instance-level)	After (Instance-level)

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers
• [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• [-] Label as security and @ mention @gitlab-com/gl-security/appsec
• [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• [-] Security reports checked/validated by a reviewer from the AppSec team

Related to #273765 (closed)