Change the unit primitive for troubleshoot job

What does this MR do and why?

This adds the unit primitive for the /troubleshoot_job slash command tool.

Similar too: !157606 (merged)

Part of making this available to Enterprise Duo customers only. Issue: #457573 (closed)

app/policies/ci/build_policy.rb

@@ -68,6 +68,33 @@ class BuildPolicy < CommitStatusPolicy
       can?(:developer_access, @subject.project)
     end
 
+    # Authorize access to the troubleshoot job to Cloud Connector Service
+    condition(:troubleshoot_job_cloud_connector_authorized) do
+      next true if troubleshoot_job_connection.allowed_for?(@user)
+
+      next false unless troubleshoot_job_connection.free_access?
+
+      if ::Gitlab::Saas.feature_available?(:duo_chat_on_saas) # check if we are on SaaS
+        user.any_group_with_ai_available?
+      else
+        License.feature_available?(:ai_features)
+      end
+    end
+
+    # Authorize access to Troubleshoot Job
+    condition(:troubleshoot_job_with_ai_authorized, scope: :subject) do
+      ::Gitlab::Llm::Chain::Utils::ChatAuthorizer.resource(
+        resource: subject.project,
+        user: @user
+      ).allowed?
+    end
+
+    condition(:troubleshoot_job_licensed) do
+      next false unless ::Feature.enabled?(:root_cause_analysis_duo, @user)
+
+      ::License.feature_available?(:troubleshoot_job)
+    end
+
     # Use admin_ci_minutes for detailed quota and usage reporting
     # this is limited to total usage and total quota for a builds namespace
     rule { can_read_project_build }.policy do
@@ -122,6 +149,17 @@ class BuildPolicy < CommitStatusPolicy
 
     rule { can_read_project_build & ~artifacts_none }.enable :read_job_artifacts
     rule { ~artifacts_public & ~project_developer }.prevent :read_job_artifacts
+
+    rule do
+      can?(:read_build_trace) &
+        troubleshoot_job_cloud_connector_authorized &
+        troubleshoot_job_with_ai_authorized &
+        troubleshoot_job_licensed
+    end.enable(:troubleshoot_job_with_ai)
+
+    def troubleshoot_job_connection
+      CloudConnector::AvailableServices.find_by_name(:troubleshoot_job)
+    end
   end
 end