Wrap instance metadata in a model so that it can have a policy

This avoids needing to special case policy checks against a hash, and
is part of a larger MR that requires GraphQL objects to respond to
authorization checks more uniformly.

See: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/40088)

app/graphql/resolvers/metadata_resolver.rb

@@ -5,7 +5,7 @@ module Resolvers
     type Types::MetadataType, null: false
 
     def resolve(**args)
-      { version: Gitlab::VERSION, revision: Gitlab.revision }
+      ::InstanceMetadata.new
     end
   end
 end

app/models/instance_metadata.rb

+# frozen_string_literal: true
+
+class InstanceMetadata
+  attr_reader :version, :revision
+
+  def initialize(version: Gitlab::VERSION, revision: Gitlab.revision)
+    @version = version
+    @revision = revision
+  end
+end

app/policies/instance_metadata_policy.rb

+# frozen_string_literal: true
+
+class InstanceMetadataPolicy < BasePolicy
+  delegate { :global }
+end

spec/graphql/resolvers/metadata_resolver_spec.rb

@@ -7,7 +7,7 @@ RSpec.describe Resolvers::MetadataResolver do
 
   describe '#resolve' do
     it 'returns version and revision' do
-      expect(resolve(described_class)).to eq(version: Gitlab::VERSION, revision: Gitlab.revision)
+      expect(resolve(described_class)).to have_attributes(version: Gitlab::VERSION, revision: Gitlab.revision)
     end
   end
 end

spec/models/instance_metadata_spec.rb

+# frozen_string_literal: true
+
+require 'fast_spec_helper'
+
+RSpec.describe InstanceMetadata do
+  it 'has the correct properties' do
+    expect(subject).to have_attributes(
+      version: Gitlab::VERSION,
+      revision: Gitlab.revision
+    )
+  end
+end

spec/policies/instance_metadata_policy_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe InstanceMetadataPolicy do
+  subject { described_class.new(user, InstanceMetadata.new) }
+
+  context 'for any logged-in user' do
+    let(:user) { create(:user) }
+
+    specify { expect_allowed(:read_instance_metadata) }
+  end
+
+  context 'for anonymous users' do
+    let(:user) { nil }
+
+    specify { expect_disallowed(:read_instance_metadata) }
+  end
+end