Validation to enforce one-external-issue-tracker is not applied consistently

Summary

The one_issue_tracker validation at https://gitlab.com/gitlab-org/gitlab/blob/050f156158126ca191c3af8a817010951a4cd95f/app/models/integrations/base_issue_tracker.rb#L5 is only applied on: :manual_change, and we only pass that in the projects controller at https://gitlab.com/gitlab-org/gitlab/blob/050f156158126ca191c3af8a817010951a4cd95f/app/controllers/projects/services_controller.rb#L36-42.

This means the validation is ignored in the group and admin controllers, and also in the API. Quickly tested this on staging, I enabled both Jira and Redmine on a group and didn't get any validation errors. And then if I go to a project in the group and save one of the integrations (without changes) I do get an error.

Improvements

Enforce the validation everywhere, maybe we can just remove on: :manual_change.

The frontend changes in !81896 (merged) are also restricted to the project level, and should be expanded to groups and instance integrations as well.

Risks

There might have been good reasons why we implemented it this way, we especially have to make sure the settings propagation still works correctly.

Involved components

• app/models/integrations/base_issue_tracker.rb
• app/controllers/projects/services_controller.rb
• app/controllers/groups/settings/integrations_controller.rb
• app/controllers/admin/integrations_controller.rb
• lib/api/integrations.rb