Document spec checks for permissions related work

Add topics verified and implemented in #403153 (closed) to the developer doc (if they make sense).

Also suggest using GITLAB_DEBUG_POLICIES in that doc.