Discussions API incorrectly masks author name for group owner with sufficient permissions
<!--IssueSummary start-->
<details>
<summary>
Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards.
</summary>
- [Work on this issue](https://contributors.gitlab.com/manage-issue?action=work&projectId=278964&issueIid=591305)
</details>
<!--IssueSummary end-->
## Summary
The discussions endpoint masks `author.name` as `"****"` even when the requesting user is a group owner with full permissions on GitLab.com.
## Steps to reproduce
1. Create a new group on GitLab.com
2. Create a new project within that group
3. Create a new user or bot account (e.g., `ai-reviewer-bot`)
4. Add the bot to the project with Developer role
5. Create a test branch and push code:
```bash
git checkout -b test-branch
echo "test" > test.txt
git add test.txt
git commit -m "test"
git push -u origin test-branch
```
6. Create a merge request from `test-branch` to the default branch
7. Add a discussion comment to the MR using the bot's account (or group access token)
8. As the group owner, query the discussions endpoint:
```bash
curl -H "PRIVATE-TOKEN: YOUR_PERSONAL_TOKEN" \
"https://gitlab.com/api/v4/projects/{PROJECT_ID}/merge_requests/{MR_IID}/discussions"
```
9. Observe that `author.name` is masked as `"****"`
10. Query the users endpoint for the same user:
```bash
curl -H "PRIVATE-TOKEN: YOUR_PERSONAL_TOKEN" \
"https://gitlab.com/api/v4/users/{USER_ID}"
```
11. Observe that the actual name is returned (not masked)
## Expected behavior
Author name should be visible to group owner in the discussions endpoint
## Actual behavior
Author name is masked as `"****"` in the discussions endpoint despite the group owner having full permissions
## Inconsistency
- `/api/v4/users/{id}` returns the actual author name
- `/api/v4/projects/{id}/merge_requests/{iid}/discussions` masks it as `"****"`
The data is clearly accessible (proven by the users endpoint), so the masking is a permission check bug in the discussions endpoint.
## Environment
- GitLab.com (SaaS)
- Token type: Personal access token (group owner)
- Affected endpoint: `GET /api/v4/projects/:id/merge_requests/:merge_request_iid/discussions`
issue