Check custom ability access on `Ci::Runner`

What does this MR do and why?

This change was extracted from !151825 (merged) in order to provide an API for checking if a user has access to a Ci::Runner that is associated with projects or groups via a custom role. The CustomAbility class mimics the same interface as the Ability.allowed? method and provides a consistent interface for performing an efficient access check.

#442851

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.