[topunix]

Fixes https://bugzilla.mozilla.org/show_bug.cgi?id=1582393

The /parameters endpoint returned "No such method" because Bugzilla.parameters was never ported to Harmony. This ports it from upstream Bugzilla (bug 443210), keeping the same access tiers:

• Logged out: maintainer and requirelogin only
• Logged in: the params already visible in the web UI
• tweakparams members: every param

Harmony-specific changes:

• urlbase and attachment_base moved from data/params to localconfig, so they are served from Bugzilla->localconfig, which matches the existing REST docs.
• cookiepath and maxlocalattachment no longer exist and are omitted.

Not included: last_audit_time from the same upstream patch. It is a separate method outside this bug, and I can port it separately if wanted.

Tested locally in Docker:

• Logged out returns only maintainer and requirelogin
• include_fields=maintainer returns only maintainer
• Admin returns all params, with urlbase read from localconfig

The plain logged-in tier was not exercised live because my local DB has no non-admin test user. It runs the same code path with a different parameter list.

[mrenvoize]

Requesting changes, mostly for tests and a policy decision. The access model reads as sound (anonymous gets maintainer/requirelogin; logged-in users a whitelist; tweakparams all keys).

1. Secrets via the API: please decide whether tweakparams users should receive secret params (smtp_password, aws_secret_access_key, duo_skey, duo_akey, duo_ikey). The web UI already shows them, but the API is easier to scrape; I'd suggest masking them.
2. Tests: there are none, and the webservice tests do not run in CI (the job is commented out in .github/workflows/ci.yml:28-37). Please add tests for the anonymous, logged-in and admin views and run them locally.
3. The docs say "Restored in 6.0" but BUGZILLA_VERSION is 5.9.1+; please correct. perltidy flags line 185.