Add defense in-depth and improve tests for EnqueueJobService

Ci::EnqueueJobService is a central point for starting manual jobs for features like protected environments, but it doesn't have good test coverage as it was shown in gitlab-com/gl-infra/production#19377 (closed)

Proposal

Add defense in depth to this service and a test case that covers the permissions for the protected environments.