Move authorization from branch rule ESC services into core ESC services

What does this MR do and why?

Move authorization from branch rule ESC services into core ESC services

The BranchRules::ExternalStatusChecks::{Create,Destroy,Update}Service previously performed their own authorization checks. Authorization now lives in the core ExternalStatusChecks::{Create,Update}Service against the project container, and in ExternalStatusChecks::DestroyService against the external_status_check record itself.

Replace the broad manage_merge_request_settings ability with the specific create/delete/update_external_status_check abilities, and remove skip_authorization from branch rule service calls since the core services now handle their own authorization.

Changelog: changed EE: true

References

Branch Rules needs to take custom role abilitie... (#584313 - closed)