Code References: Add vcs_provider support and GitLab CI template

Start with src/code_references/cli/upload_code_references.py, types.py, .github/actions/upload-code-references/action.yml, and the reusable workflow to trace the upload payload and existing scan steps. Run the upload tests, adding coverage for explicit and default vcs_provider values and VCS_PROVIDER environment handling. Create templates/gitlab-ci.yml with the specified inputs, image, rules, variables, and single fetch/scan/upload job; done means the acceptance criteria and all tests pass.

Context: https://github.com/Flagsmith/flagsmith/issues/7000
Depends on: https://github.com/Flagsmith/flagsmith/issues/7134

The upload script doesn't send vcs_provider in the API payload, and there's no GitLab CI template. The scanning logic itself is already platform-agnostic.

Scope

Make the upload script send vcs_provider, and create a GitLab CI template that reuses the existing Python scanning logic.

Upload script

src/code_references/cli/upload_code_references.py: read $VCS_PROVIDER (default "github"), include it in the JSON body. Add vcs_provider: NotRequired[str] to the FeatureFlagCodeReferencesScan TypedDict in types.py.

Wire it through the GitHub Actions too: add a vcs_provider input to .github/actions/upload-code-references/action.yml (default "github") and forward it in the reusable workflow. Existing GitHub users are unaffected.

GitLab CI template

New file: templates/gitlab-ci.yml

Consumed via include:remote from the raw GitHub URL. Use spec:inputs with $[[ inputs.* ]] interpolation so users can pass flagsmith_project_id and optionally flagsmith_admin_api_url.

Design points:

• GitLab shared runners use Docker executors, so the template must specify an image — ghcr.io/astral-sh/uv:python3.14-alpine has uv and Python pre-installed.
• Run in the .post stage so it doesn't interfere with the project's own pipeline.
• Only run on the default branch: rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH (both are predefined variables).
• Map $CI_PROJECT_URL to REPOSITORY_URL and $CI_COMMIT_SHA to REVISION.
• Hardcode VCS_PROVIDER=gitlab.
• The API key comes from $FLAGSMITH_CODE_REFERENCES_API_KEY, a CI/CD variable the user sets in project settings.
• Run all three steps (fetch, scan, upload) in a single job via uv run --from git+https://github.com/Flagsmith/ci.git@v1.0.0.

Tests

• Upload with explicit vcs_provider includes it in the payload
• Upload without vcs_provider defaults to "github"
• main() reads $VCS_PROVIDER from the environment

Acceptance criteria

• Existing GitHub CI clients unaffected
• templates/gitlab-ci.yml works with include:remote + inputs:
• Template reuses the same Python scanning logic as GitHub Actions
• All new code has test coverage