Bug 2074854 - Recognize USAGE_MODE_MOJO_REST as a webservice mode in i_am_webservice

[Xzzz]

Summary

i_am_webservice() returns true for USAGE_MODE_JSON and USAGE_MODE_REST but not for USAGE_MODE_MOJO_REST, so all call sites treat native Mojo REST requests as browser requests.

Split out of bug 2072313 at review request: the change flips behaviour for every USAGE_MODE_MOJO_REST endpoint at once rather than for the single endpoint being migrated, so it does not belong inside a migration PR. This PR stands on its own and does not depend on any other open PR.

Changes

• Bugzilla/Util.pm: add USAGE_MODE_MOJO_REST to i_am_webservice()
• qa/t/rest_components.t: assert the exact auth_failure message on an unprivileged POST /rest/component/Firefox. At 110 characters it is long enough that an exact match fails while the 72-column wrap is applied
• qa/t/rest_github_push_comment.t: set restrict_comments on a bug, fire a push event against it, and assert a user outside restrict_comments_group still cannot react to the resulting comment

Behaviour changes

Three call sites change observably for native REST endpoints:

• Bugzilla/Template.pm:866: the error_message filter no longer wraps at 72 columns, so error messages over that length stop coming back with embedded \ns. This is the motivating fix, but it is a response-shape change for already-shipped endpoints
• extensions/RestrictComments/Extension.pm:58: object_end_of_set_all stops force-clearing restrict_comments on bug updates made through Bugzilla/API/V1/Github.pm:364 and extensions/PhabBugz/lib/API/V1/PhabBugz.pm:235. Both run as users granted every group, so _can_restrict_comments() is always true there, and Bugzilla->input_params is never populated on the native Mojo path -- meaning the field is currently cleared on every touched bug. Covered by the new test
• Bugzilla.pm:593: log_user_request starts logging native REST requests when log_user_requests is enabled, which will increase the volume written to that log

The MFA and password-reset branches (Bugzilla.pm:265, :285, :305, Bugzilla/Auth.pm:91) and the Quicksearch shortcuts (Bugzilla/Search/Quicksearch.pm:342, :367) are corrected in the same pass. The Bugzilla::Auth::Login::* and Bugzilla::Auth::Verify::DB call sites are unreachable under USAGE_MODE_MOJO_REST, since native REST authenticates through Bugzilla/App/Plugin/Login.pm.

Test plan

• POST /rest/component/Firefox as a user without editcomponents, expect 401 and a message with no embedded newline
• Set restrict_comments on a bug, send a push webhook naming it, confirm the restriction survives the automation update
• Existing qa/t/rest_components.t and qa/t/rest_github_push_comment.t cases unaffected

Note

PRs #2745 and #2751 currently carry this same one-line change to Bugzilla/Util.pm. It will be dropped from both once this lands, so neither is a prerequisite here and this PR can be reviewed and merged independently.

References

• Bugzilla link: 2074854
• Split out of 2072313