Fix project_ability for admin_security_attributes and read_security_attribute custom abilities

What does this MR do and why?

Both admin_security_attributes and read_security_attribute custom abilities were incorrectly set to project_ability: false, preventing custom roles from managing security attributes at the project level. Original design intent #562417 (closed) enabled project-level access and adding the corresponding project_permissions and enabled_for_project_access_levels fields. Project "Security Configuration" UI still mentions: "Project Owners and Maintainers can add or remove attributes to this project as needed."

References

• Resolves #601937 (closed)
• Original permissions design: #562417 (closed)