Add create_epic permissions at projecl level

To create projecl-level work items with the type Epic we need to be able to access the create_epic permission in ProjectPolicy.

Given this change will allow the creation of these work item epics, we should also ensure that legacy epics syncing is skipped when the container is a project. As an example:

diff --git a/ee/app/services/ee/work_items/create_service.rb b/ee/app/services/ee/work_items/create_service.rb
--- a/ee/app/services/ee/work_items/create_service.rb	(revision 4502922b2daa890fa876eb5af5e52f26d12c6c4f)
+++ b/ee/app/services/ee/work_items/create_service.rb	(date 1737044625511)
@@ -12,7 +12,7 @@
 
       override :transaction_create
       def transaction_create(work_item)
-        return super unless work_item.epic_work_item?
+        return super unless work_item.epic_work_item? && container.is_a?(Namespace)
 
         super.tap do |save_result|
           break save_result unless save_result