Grant metric image permissions through role YAML

What does this MR do and why?

The authorization review guidelines say role YAML files are the source of truth for permissions, and policies should only add prevent rules, so roles can be enumerated from the YAML alone. Metric image permissions were granted inside EE::IssuablePolicy instead, so they could not be read from role YAML.

• Add read_issuable_metric_image to config/authz/roles/guest.yml, and upload_issuable_metric_image, update_issuable_metric_image and delete_issuable_metric_image to config/authz/roles/reporter.yml, inherited by higher roles. Also add read_issuable_metric_image to config/authz/roles/auditor.yml. Remove the grant rules from EE::IssuablePolicy.
• Add a ~is_incident prevent rule for all 4 permissions in EE::IssuePolicy, since metric images only exist on incidents, and move the existing ~is_container_member prevent there from EE::IssuablePolicy.
• Add the 3 write permissions to the existing ~can?(:read_issue) block in IssuePolicy, so nobody can change images on an incident they can't see, and to the project:archived and project:pending_deletion permission groups. These restrictions used to apply to them only through update_issue.
• Add per-permission specs with role tables in ee/spec/policies/issue_policy_spec.rb, and update the issuable, issue and work item policy specs to match.

Metric image permissions are now denied on issuables that are not incidents, including regular issues and synced epics. In practice those have no images, because upload already required an incident. Incident behaviour does not change.

References

• Follow-up to !258088 (merged)
• Follow-up to !258806 (merged)

Screenshots or screen recordings

No UI change.

How to set up and validate locally

bin/rspec ee/spec/policies/issue_policy_spec.rb -e metric_image
bin/rspec ee/spec/policies/issuable_policy_spec.rb ee/spec/policies/work_item_policy_spec.rb
bin/rspec ee/spec/requests/api/issues_spec.rb -e metric_images -e 'metric images'
bundle exec rake gitlab:permissions:validate

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.