Update work item hierarchy permissions

What does this MR do and why?

Adding and removing a work item child should require guest role (and be able to read the WI to cover confidential cases). Additionally, when the work item type is Epic we should check that the licensed feature subepics is available.

Issue: #451455

Video of local testing

video1107149270

How to set up and validate locally

1. To test this locally, you need to enable WI at group level, so you will have to enable these feature flags namespace_level_work_items (If you are still unable to access work-item page for an epic then enable/disble FF from this list -&11777 )
2. Visit master brach locally as root(admin)
3. Visit Epics page and try to create a new EPIC(If all relevant FF's are enabled then you should see a modal when you click on New Epic)
4. Open the newly created epic and replace epics in the URL with work_items, SO the target URL would be something like http://127.0.0.1:3000/groups/flightjs/-/work_items/6
5. Now Login as Guest and visit the above EPIC work item URL and you will not see Add button in the Childs section
6. Switch your branch to akotte-update-work-item-hierarchy-permissions branch and Visit the EPIC work item page, you should see the Add button.
7. You should be able to successfully add child items using the Add button.