Require update access to create closing work item relations

What

MergeRequests::WorkItemRelations::CreateService authorized closes links with the same read check it uses for related links. A closes link auto-closes the work item when the MR merges, so read access is not enough: a user who can only read an issue could attach a closes link from their own merge request and close that issue on merge, bypassing update authorization.

This requires :update_work_item on the target for closes links, mirroring WorkItems::ClosingMergeRequests::CreateService. related links stay on read access.

The feature is behind the disabled explicit_mr_work_item_relations flag, so there is no released impact. Raised in review on gitlab-org/gitlab#601174.

Note on exploitability

The close on merge only succeeds when the closing reference never lands in the merge/squash commit message, i.e. a fast-forward merge. The default merge-commit method masks it, because the auto-generated Closes line re-derives the relation and restores the update check.

Verification

Reproduction before the fix: a read-only user closes another user's issue by attaching a closes link via GraphQL and fast-forward merging their own MR.