Reach the merge request routes no action sends (R-ROUTE, merge_request domain) #1608

R-ROUTE (go run ./cmd/audit_1to1/ -scope=routes, which the auditor stack of #1595 adds) holds every route the live API record mounts (docs/development/gitlab-api-live.json, 19.5.0-ee) to an action that sends it or to a reason none does, and fails on a route nothing answers. The 8 routes below are GitLab's to a caller with a token, and no action sends them yet, so the tracked rows of cmd/audit_1to1/internal/routes/family_table.go that name issueMergeRequestRoutes, the constant holding this issue's number, declare them for the merge_request domain. Each row pins how many routes it answers.

GET /projects/*/merge_requests/*/changes (1): reads a merge request with its changes, through MergeRequests.GetMergeRequestChanges, which GitLab deprecates for the list of its diffs; mr_review.changes_get lists the diffs (GET /projects/:id/merge_requests/:merge_request_iid/diffs), another route.

• GET /projects/:id/merge_requests/:merge_request_iid/changes: Retrieve merge request changes (client-go v3.30.0: MergeRequests.GetMergeRequestChanges)

POST /projects/*/merge_requests/*/approvals (1): changes the approvals a merge request requires, through MergeRequestApprovals.ChangeApprovalConfiguration, which GitLab deprecated in 16.0 for its approval rules (merge_request.approval_rule_*) and still serves.

• POST /projects/:id/merge_requests/:merge_request_iid/approvals: Change approval-related configuration (client-go v3.30.0: MergeRequestApprovals.ChangeApprovalConfiguration)

GET /projects/*/merge_requests/*/approval_rules/* (1): reads one approval rule of a merge request, which merge_request.approval_rules lists.

• GET /projects/:id/merge_requests/:merge_request_iid/approval_rules/:approval_rule_id: Retrieve an approval rule for a specific merge request

GET /projects/*/merge_requests/*/approval_settings (1): lists a merge request's approval rules through the approval settings API.

• GET /projects/:id/merge_requests/:merge_request_iid/approval_settings: List approval rules for merge request

GET /projects/*/merge_requests/*/blockees (1): lists the merge requests a merge request blocks; merge_request.dependencies_list lists those that block it.

• GET /projects/:id/merge_requests/:merge_request_iid/blockees: Retrieve blocked merge requests

GET /projects/*/merge_requests/*/blocks/* (1): reads one dependency of a merge request, which merge_request.dependency_create and merge_request.dependency_delete create and delete.

• GET /projects/:id/merge_requests/:merge_request_iid/blocks/:block_id: Retrieve a merge request dependency

GET /projects/*/merge_requests/*/merge_ref (1): merges a merge request's changes into its merge ref (refs/merge-requests/:iid/merge) when they merge, which shows whether they do.

• GET /projects/:id/merge_requests/:merge_request_iid/merge_ref: Merge to default merge ref path

GET /analytics/code_review (1): lists a project's open merge requests with their review metrics (Code Review Analytics).

• GET /analytics/code_review: List code review information about project

GET .../changes was COVERED_GENERIC in R-ACTION's acceptedMissingMethods (GitLab deprecates it for the diffs list, which mr_review.changes_get sends and #1584 made it page through, and which this issue does not redo), and POST .../approvals INTENTIONAL_SKIP_OTHER (deprecated in 16.0). Those entries left that table with this triage, so R-ACTION lists the methods as its backlog until an action calls each one, and the R-ROUTE gate refuses a tracked row over a route a COVERED_GENERIC or INTENTIONAL_SKIP_* decision settles.

The fix: an action for each route, with every param the route declares and an e2e scenario under test/e2e/gitlab. A route an action starts sending leaves its row answering one route less, and the gate fails until the row's pinned count follows; a row that answers nothing goes. The client-go bump is the moment to check which of these routes gained a method.