Fix ability for admin_security_attributes and read_security_attribute

What does this MR do and why?

Both admin_security_attributes and read_security_attribute custom abilities were incorrectly set to project_ability: false, preventing custom roles from managing security attributes at the project level.

Original design intent #562417 (closed) enabled project-level access and added the corresponding project_permissions and enabled_for_project_access_levels fields. Project "Security Configuration" UI still mentions: "Project Owners and Maintainers can add or remove attributes to this project as needed."

Changelog: fixed
EE: true

References

Related to #601937 (closed)
Based on !248496 (closed) with some added specs

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.