Add `admin_runners` custom role permission

What does this MR do and why?

This change introduces a new custom permission to allow users the ability to manage runners for a group or project.

#442851 (closed)

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Before	After
	After: Enable/Disable instance runners for Group

How to set up and validate locally

1. In rails console enable the experiment fully

   Feature.enable(:custom_ability_admin_runners)

2. Create a role with the Admin Runners permission enabled.
3. Assign the new role to a new user
4. Login with the new user
5. Visit any project page and ensure that the Settings menu item appears in the navigation.
6. Click on the Settings menu and ensure that the CI/CD menu item appears.
7. Click on the CI/CD menu.
8. Ensure that the Runners section appears.
9. Click on Expand
10. Ensure that the list of runners are displayed.

ee/app/models/auth/member_role_ability_loader.rb

@@ -18,7 +18,7 @@ def has_ability?
 
     class << self
       def allowed?(user, resource, ability)
-        return false unless resource.custom_roles_enabled?
+        return false if resource.respond_to?(:custom_roles_enabled?) && !resource.custom_roles_enabled?
 
         new(user: user, resource: resource, ability: ability).has_ability?
       end
@@ -32,20 +32,16 @@ def permission_enabled?
       ::MemberRole.permission_enabled?(ability)
     end
 
-    def preloaded_member_roles_for_projects(projects)
+    def abilities_for_projects(projects)
       ::Preloaders::UserMemberRolesInProjectsPreloader.new(
         projects: projects,
         user: user
       ).execute
     end
 
-    def preloaded_member_roles_for_project
-      preloaded_member_roles_for_projects([resource])
-    end
-
-    def preloaded_member_roles_for_group
+    def abilities_for_groups(groups)
       ::Preloaders::UserMemberRolesInGroupsPreloader.new(
-        groups: [resource],
+        groups: groups,
         user: user
       ).execute
     end
@@ -53,14 +49,15 @@ def preloaded_member_roles_for_group
     def abilities_for(resource)
       case resource
       when ::Project
-        preloaded_member_roles_for_project[resource.id]
+        abilities_for_projects([resource])[resource.id]
       when ::Group
-        preloaded_member_roles_for_group[resource.id]
+        abilities_for_groups([resource])[resource.id]
       when Ci::Runner
-        ::Preloaders::UserMemberRolesInProjectsPreloader.new(
-          projects: resource.projects,
-          user: user
-        ).execute.flat_map { |(_project_id, abilities)| abilities }
+        if resource.project_type?
+          abilities_for_projects(resource.projects)
+        else
+          abilities_for_groups(resource.groups)
+        end.flat_map { |(_id, abilities)| abilities }
       else
         []
       end