fix: bump gitlab-ai-provider to 5.3.3 for DWS tool approval support

[vglafirov]

Issue for this PR

Closes #19186

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Bumps gitlab-ai-provider from 5.3.2 to 5.3.3 to fix workflow model tools being silently cancelled.

DWS has a multi-layered tool approval system. The server only pre-approves certain privilege groups (read_write_files, read_only_gitlab), while tools in run_commands, run_mcp_tools, use_git, and read_write_gitlab require explicit approval. The provider was missing tool_approval_for_session_enabled: true in workflow metadata, so DWS silently discarded the client-side preapproved_tools list. When DWS then sent TOOL_CALL_APPROVAL_REQUIRED checkpoints, the provider didn't handle them, causing the stream to hang indefinitely.

Changes in gitlab-ai-provider 5.3.3:

1. Added tool_approval_for_session_enabled: true to workflow metadata so DWS respects client-side preapproved tools
2. Added TOOL_CALL_APPROVAL_REQUIRED to the processCheckpoint status allowlist
3. Added TOOL_CALL_APPROVAL_REQUIRED / PLAN_APPROVAL_REQUIRED handling in the WebSocket client to prevent stream hangs

How did you verify your code works?

• Linked local gitlab-ai-provider build into opencode and verified the fix resolves to the correct dist
• All 478 gitlab-ai-provider tests pass
• opencode typecheck passes (13/13 packages)

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍