Add a new permission for the container expiration policy

What does this MR do?

This merge request adds a new permission for container expiration policy. As described at #220259, the container expiration policy is currently gated behind the following permission: destroy_container_image which is not explicit.

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• If the refactoring is not done correctly, access to the container expiration policy feature could be denied to users.
  • This risk is mitigated by the test suite.

Closes #220259