Guard branch_protection with pure access-level entries checks

Giannis Kepasrequested to merge
gitlab-community/gitlab-org/terraform-provider-gitlab:6849-fix-branch-protection into main

Fixed a bug in internal/provider/resource_gitlab_branch_protection.go: populateBranchPermissionOptionsData and populateBranchPermissionOptionsDataForPush used an OR-based match that let a planned access_level entry get incorrectly treated as "already existing" whenever any user/group/deploy-key entry in the API response happened to share that access level (since those entries carry an AccessLevel field reflecting the principal's role). The access-level entry was then silently dropped from the API request, causing Terraform's "produced inconsistent result after apply" error on the next update.

Add a guard to the access-level match to only fire against "pure" access-level entries (UserID == 0 && GroupID == 0, plus DeployKeyID == 0 for push), while user/group/deploy-key matches stay as separate independent checks.

Closes #6849 (closed)

Merge request reports