Stop empty external auth classification labels overriding default labels

Most of the project templates bundled with GitLab have an empty string
set for `external_authorization_classification_label` in their
`project.json`. When imported this overrides the default label set on
the instance, causing the label to appear empty.

This change sets empty labels to nil during import, allowing the
default label to override it and be applied to the project.

changelogs/unreleased/use_default_external_auth_label_empty.yml

+---
+title: Prevent empty external authorization classification labels from overriding
+  the default label
+merge_request: 32517
+author: Will Chandler
+type: fixed

lib/gitlab/import_export/project_tree_restorer.rb

@@ -107,7 +107,7 @@ module Gitlab
 
       def project_params
         @project_params ||= begin
-          attrs = json_params.merge(override_params).merge(visibility_level)
+          attrs = json_params.merge(override_params).merge(visibility_level, external_label)
 
           # Cleaning all imported and overridden params
           Gitlab::ImportExport::AttributeCleaner.clean(relation_hash: attrs,
@@ -135,6 +135,13 @@ module Gitlab
         { 'visibility_level' => level }
       end
 
+      def external_label
+        label = override_params['external_authorization_classification_label'].presence ||
+          json_params['external_authorization_classification_label'].presence
+
+        { 'external_authorization_classification_label' => label }
+      end
+
       # Given a relation hash containing one or more models and its relationships,
       # loops through each model and each object from a model type and
       # and assigns its correspondent attributes hash from +tree_hash+

spec/lib/gitlab/import_export/project_tree_restorer_spec.rb

@@ -512,6 +512,24 @@ describe Gitlab::ImportExport::ProjectTreeRestorer do
         expect(Milestone.find_by_title('Group-level milestone').iid).to eq(2)
       end
     end
+
+    context 'with external authorization classification labels' do
+      it 'converts empty external classification authorization labels to nil' do
+        project.create_import_data(data: { override_params: { external_authorization_classification_label: "" } })
+
+        restored_project_json
+
+        expect(project.external_authorization_classification_label).to be_nil
+      end
+
+      it 'preserves valid external classification authorization labels' do
+        project.create_import_data(data: { override_params: { external_authorization_classification_label: "foobar" } })
+
+        restored_project_json
+
+        expect(project.external_authorization_classification_label).to eq("foobar")
+      end
+    end
   end
 
   describe '#restored_project' do