docs: clarify GitLab access token requirements and update setup instructions

docs/integrations/app-connections/gitlab.mdx

@@ -204,13 +204,27 @@ Infisical supports two methods for connecting to GitLab: **OAuth** and **Access
 
             <Tabs>
                 <Tab title="Secret Sync">
-                  For Secret Syncs, your token will require the `api` scope and at least a **Maintainer** role or higher.
+                  For Secret Syncs, the required role depends on your sync destination:
+                  - **Project variables**: Requires **Maintainer** role or higher
+                  - **Group variables**: Requires **Owner** role
+
+                  Your token will require the `api` scope.
+
                   ![GitLab Create Group Token](/images/app-connections/gitlab/gitlab-group-access-token-form-secret-sync.png)
 
                   Click **Create group access token** to create the token.
+
+                  <Note>
+                    Use the **Owner** role if you need to sync to group-level variables. The **Maintainer** role is sufficient only for project-level variables.
+                  </Note>
                 </Tab>
                 <Tab title="Secret Scanning">
-                    For Secret Scanning, your token will require the `api` scope and at least a **Maintainer** role or higher.
+                     To set up Secret Scanning, the required permissions depend on the data source level:
+                      - **Project-level data source:** Requires **Maintainer** role or higher
+                      - **Group-level data source:** Requires **Owner** role
+
+                    Your token will require the `api` scope.
+
                   ![GitLab Create Group Token](/images/app-connections/gitlab/gitlab-group-access-token-form-secret-sync.png)
 
                   Click **Create group access token** to create the token.
@@ -229,10 +243,12 @@ Infisical supports two methods for connecting to GitLab: **OAuth** and **Access
           </Warning>
         </Step>
       </Steps>
-      </Tab>
-    </Tabs>
 
-    ## Setup GitLab Access Token Connection in Infisical
+    </Tab>
+
+</Tabs>
+
+## Setup GitLab Access Token Connection in Infisical
 
   <Steps>
   <Step title="Navigate to App Connections">
@@ -249,12 +265,14 @@ Infisical supports two methods for connecting to GitLab: **OAuth** and **Access
       ![Configure Access Token](/images/app-connections/gitlab/create-gitlab-access-token-connection.png)
 
       Click **Connect** to establish the connection.
+
     </Step>
+
   <Step title="Connection Created">
     Your **GitLab Connection** is now available for use.
     ![GitLab Access Token Connection](/images/app-connections/gitlab/gitlab-access-token-connection.png)
   </Step>
-    </Steps>
+</Steps>
 
   </Tab>
 </Tabs>