Change ability checks to use cancel rather than update for cancellation

What does this MR do and why?

There were a few spots left over to switch from update_build to cancel_build and from update_pipeline to cancel_pipeline after these MRs:

1. Add an enum column with the relevant role (DEVELOPERS, MAINTAINERS, null or NO_ONE) and ensure that it can be updated via an api. We could start with just a REST Internal api and then open a separate issue to add it to the public apis. !135047 (merged) ✅
2. Split out cancel_pipeline from update_pipeline ✅ !134408 (merged)
3. Split out cancel_build from update_build. !135587 (merged) ✅
4. Add the relevant logic to policies to ensure that the new cancel_build ability changes based on roles. !135047 (merged) ✅

This also includes some small related cleanup.

Related to #20207 (closed)