Authorize Project.componentUsages with a policy permission instead of access-level checks

Problem

ProjectUsageResolver, which backs Project.componentUsages, decides who can see the data with hand-written checks instead of a policy permission:

  • On GitLab.com you need at least Maintainer on the project's parent group (max_member_access_for_user). Project-level Maintainers are denied, and projects in personal namespaces never return data.
  • On self-managed, only instance admins can see it (can_admin_all_resources?).
  • The SaaS and self-managed branches repeat licence logic that licensed_feature_available? already handles.
  • CiCatalogResourceComponentUsage has no type authorization, only a rubocop disable, and LastUsage has no policy.

After !267264 (merged), tokens are checked for read_ci_component_usage but users aren't, so the two checks don't match.

Proposal

  1. Grant read_ci_component_usage as a user permission on the consuming project, to Maintainer and Auditor. That matches read_project_component_usages on the publisher side.
  2. In the EE ProjectPolicy, block it unless licensed_feature_available?(:ci_component_usages_in_projects).
  3. Add belongs_to :used_by_project to LastUsage and a LastUsagePolicy that delegates to that project.
  4. UsageType: authorize :read_ci_component_usage and drop the rubocop disable.
  5. ProjectUsageResolver: authorize :read_ci_component_usage with authorizes_object!, and replace the group, licence and admin checks with a plain batch load.

Behaviour change (needs product sign-off)

  • Project Maintainers and Auditors gain access, including on personal-namespace projects.
  • Maintainers on self-managed gain access.
  • Projects you can't see return null instead of [].

The current rule came from !173816 (merged), which doesn't say why. The components a project uses are already readable in its .gitlab-ci.yml, so this exposes only last_used_date. If product wants to keep group-only access, grant the permission in the group: role section and check it against project.group in the resolver.