Allow security policy bot to pull container images via job token

What does this MR do and why?

The 19.0 least-privilege refactor moved the security policy bot's project-scoped abilities into an explicit YAML allowlist (config/authz/roles/security_policy_bot.yml) and added a prevent_all rule (ee/app/policies/ee/project_policy.rb) that revokes every ability not on that list.

build_read_container_image was missing from the allowlist, so Scan Execution Policy jobs run by the security policy bot lost the ability to pull scanner images from a private container registry via CI_JOB_TOKEN authentication — even in projects where this previously worked. Registry pulls fail with:

pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

This mirrors a sibling regression already fixed for read_build in #577916 (closed), caused by the same allowlist gap. The fix here follows the identical pattern: add the missing permission to the YAML role.

Reproduction

Confirmed via ee/spec/policies/project_policy_spec.rb: before this change, expect_allowed(:build_read_container_image) fails for the security policy bot with the DeclarativePolicy trace showing prevent when security_policy_bot winning over the ability, because it isn't in the YAML allowlist.

Screenshots or demo

N/A — backend policy fix, no UI change.

How to set up and validate locally

1. Add the security policy bot as a guest member of a project.
2. Run: bundle exec rspec ee/spec/policies/project_policy_spec.rb -e "security_policy_bot policy"
3. Confirm all examples pass, including the new expect_allowed(:build_read_container_image) assertions.

References

• #606691 (closed)
• #577916 (closed) (sibling regression, same root cause pattern)