Add permission checks to scan profile create, edit, and delete actions

Summary

The scan profile list and drawer expose Create, Edit, and Delete actions for scan profiles but do not yet gate them on the user's actual group permissions. Currently, the only guard for Edit/Delete is gitlabRecommended (GitLab-managed profiles can't be edited or deleted, custom ones always can). A user with read-only access to the group can see and trigger these actions even when the backend would reject the mutation. The Create button is similarly visible to users who hold read_security_scan_profiles but not create_security_scan_profiles, leading to form submission attempts that fail with generic alerts and Sentry events.

What to do

Add userPermissions { createSecurityScanProfiles updateSecurityScanProfiles deleteSecurityScanProfiles } to the group_available_security_scan_profiles query and wire them through:

• ScanProfileDrawer → ScanProfileList to gate the Create button
• ScanProfileDrawer → ScanProfileDetail to gate Edit and Delete actions via the existing disable/tooltip path

The userPermissions query shape and the root_ancestor scoping are already established in !252340 (merged).

Context

Flagged as a non-blocking suggestion by @mfluharty in !255995 (merged) (Edit/Delete). Extended to include Create button by @anasshahid in !256222 (merged).