Enforce :read_commit_status on CiJob

This applies the :read_commit_status policy to the `CiJob` GraphQL
entities, which are `CommitStatus` objects.

This policy guards against information exposure, and we can apply this
now that `CiJob.needs` has the correct type.

A test is added to ensure we read all fields of `CiBuildNeed` during
tests, to prevent regressions.

app/graphql/types/ci/job_type.rb

@@ -2,9 +2,9 @@
 
 module Types
   module Ci
-    # rubocop: disable Graphql/AuthorizeTypes
     class JobType < BaseObject
       graphql_name 'CiJob'
+      authorize :read_commit_status
 
       field :pipeline, Types::Ci::PipelineType, null: true,
             description: 'Pipeline the job belongs to'

spec/graphql/types/ci/job_type_spec.rb

@@ -4,6 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Types::Ci::JobType do
   specify { expect(described_class.graphql_name).to eq('CiJob') }
+  specify { expect(described_class).to require_graphql_authorizations(:read_commit_status) }
 
   it 'exposes the expected fields' do
     expected_fields = %i[