Add permission checks to scan profile create, edit, and delete actions

What does this MR do and why?

Gate scan profile actions on group permissions

Read createSecurityScanProfiles, updateSecurityScanProfiles and
deleteSecurityScanProfiles from group.userPermissions in
ScanProfileDrawer, and pass them to ScanProfileList and
ScanProfileDetail. Disable the New profile and Duplicate buttons
without create, and disable the Edit and Delete items in the actions
dropdown by their own permission.

Disable each action rather than hide it, and explain it with
InsufficientPermissionsPopover, using a description that names the
denied action. Gate Duplicate on create, since it makes a new profile.
Point each item popover at the dropdown list item, because gitlab-ui
turns off pointer events on a disabled item's content. Default every
permission prop to false so a missing permission keeps the action
disabled.

Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/629967

References

• issue: Add permission checks to scan profile create, e... (#629967 - closed)
• prototype: https://security-coverage-prototype-0b2bbb.gitlab.io/security-inventory-profiles/#/security-configuration
• epics: Advanced Secret Detection Configuration Profile (gitlab-org#20198), Advanced SAST Configuration Profile (gitlab-org#20199)

Screenshots or screen recordings

User can	Before (all actions shown in all cases)	After (unavailable actions disabled individually)
only read scan profiles
create and edit, not delete
delete, not create or edit
delete, not create or edit
keyboard navigation

How to set up and validate locally

0. git checkout 629967-gate-scan-profile-actions-on-permissions-in-scan-profile-drawer
   echo "Feature.enable(:custom_scan_profiles_ui)" | gdk rails c

1. have a GitLab Ultimate licence

2. in gdk rails c, run this with ID set to a top-level group's ID. It creates three users in that group, each with a different set of scan profile permissions:

   expand for seed script

   group = Group.find(ID)
   admin = User.find_by!(username: 'root')
   
   roles = {
     'scan-profile-editor' => %i[read_security_scan_profiles apply_security_scan_profiles create_security_scan_profiles update_security_scan_profiles],
     'scan-profile-deleter' => %i[read_security_scan_profiles apply_security_scan_profiles delete_security_scan_profiles],
     'scan-profile-viewer' => nil
   }
   
   roles.each do |username, abilities|
     user = User.find_by(username: username) || Users::CreateService.new(admin,
       username: username, name: username.titleize, email: "#{username}@example.com",
       password: SecureRandom.hex(16) + 'Aa1!', skip_confirmation: true,
       organization_id: group.organization_id).execute.payload[:user]
     member = group.add_member(user, Gitlab::Access::DEVELOPER)
     next unless abilities
   
     role = MemberRole.find_or_initialize_by(name: username.titleize, organization_id: group.organization_id)
     role.base_access_level = Gitlab::Access::DEVELOPER
     role.permissions = MemberRole.all_customizable_permissions.keys.index_with { |key| abilities.include?(key) }
     role.save!
     member.update!(member_role: role)
     Authz::UserGroupMemberRoles::UpdateForGroupWorker.new.perform(member.id)
   end

3. as root, go to that group => Secure => Security configuration

4. next to Secret Detection, select Manage profiles

5. if there is no custom profile in the list, select New profile and create one

to check each user

impersonate each user from Admin => Users, open Manage profiles again, and select the custom profile

1. as scan-profile-editor, check that:
   • New profile and Duplicate are enabled
   • in the actions dropdown, Edit is enabled and Delete is disabled
   • hovering Delete shows Action unavailable with You don't have permission to delete scan profiles in this group.
2. as scan-profile-deleter, check that:
   • New profile and Duplicate are disabled, and hovering either one shows You don't have permission to create scan profiles in this group.
   • in the actions dropdown, Edit is disabled and Delete is enabled
   • hovering Edit shows You don't have permission to edit scan profiles in this group.
3. as scan-profile-viewer, check that:
   • New profile and Duplicate are disabled
   • the actions dropdown is disabled, and hovering it shows You don't have permission to edit or delete scan profiles in this group.

to check nothing changed for full access

1. as root, select the custom profile, and check that every action is enabled with no popover
2. select Secret Detection (default), and check that the actions dropdown is disabled with the existing GitLab-managed profiles can't be edited or deleted. tooltip, and no permission popover

to run tests

yarn jest ee/spec/frontend/security_configuration/components/scan_profiles/scan_profile_detail_spec.js ee/spec/frontend/security_configuration/components/scan_profiles/scan_profile_list_spec.js ee/spec/frontend/security_configuration/components/scan_profiles/scan_profile_drawer_spec.js ee/spec/frontend/security_configuration/components/scan_profiles/insufficient_permissions_popover_spec.js

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.