Add abilities for cross project group features

Move the read_cross_project check from the GroupsHelper into the GroupPolicy. Having separate abilities for each of the sidebar items:

if can?(current_user, :read_group_activity, @group)
  links << :activity
end

if can?(current_user, :read_group_issues, @group)
  links << :issues
end

if can?(current_user, :read_group_labels, @group)
  links << :labels
end

if can?(current_user, :read_group_milestones, @group)
  links << :milestones
end

if can?(current_user, :read_group_merge_requests, @group)
  links << :merge_requests
end

To be addressed after !3709 (closed)

---

The following discussion from !3709 (closed) should be addressed:

• @DouweM started a discussion: (+2 comments)

  To simplify the diff of this file with CE, what do you think about (in a next iteration) defining :view_activity, :view_issues etc abilities on GroupPolicy, that are enabled by default, but rejected unless can?(:read_cross_project)? The enable/prevent model of the policy framework makes it really easy to override certain things in EE without messing with CE code too much.

cc @DouweM