Move model registry and experiments read permissions to role YAMLs

What does this MR do and why?

Moves read_model_registry and read_model_experiments from policy enable cascades to the guest and public_anonymous role YAMLs.

The previous pattern used separate enable rules for public projects and guest members on non-public projects. This is equivalent to having the permissions in the guest and public_anonymous role YAMLs with prevent rules when the features are disabled.

The read and write prevents are consolidated into single blocks per feature.

This follows the authorization review guidelines which recommend enabling permissions directly by role rather than cascading through intermediate abilities.

References

• #599583

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.