[BE] Ensure privileges, policies and abilities are properly set up for custom types

MR: Remove prevent rule for read_work_item_type in ... (!229591)

We likely want to use the create_work_item permission or introduce a new create_work_item_of_custom_type. Right now we look up the permission based on the base_type (in Issues::BuildService), which doesn't work for custom types.