Add admin_cicd_variables custom ability for groups

What does this MR do and why?

This allows admin access to Group CI/CD variables as a customizable ability, so that it can be added onto any base role.

Issue: #437947 (closed)

Screenshots or screen recordings

Group member with base access level guest and the custom admin_cicd_variables role:

How to set up and validate locally

1. Enable the custom_ability_admin_cicd_variables Feature Flag:

   Feature.enable(:custom_ability_admin_cicd_variables)

2. Create a group and apply the Ultimate license
3. If SaaS mode is:
   • off: Visit http://localhost:3000/admin/application_settings/roles_and_permissions and create a custom role with the Admin cicd variables permission enabled, based on Guest access
   • on: Visit http://localhost:3000/groups/${new_group}/-/settings/roles_and_permissions and create a custom role with the Admin cicd variables permission enabled, based on Guest access
4. Invite a user to the group and assign the new custom role to the user
5. Visit http://localhost:3000/groups/${new_group}/-/settings/ci_cd and verify the page is accessible and you can view/create/edit/delete group variables