Extend ability to read audit events via API to more roles

🧩 What does this MR do?

Extend the ability to read audit events via API to more roles.

This MR will extend the ability to query project and group audit events via API to more roles.

Group-level audit events (https://docs.gitlab.com/ee/api/audit_events.html#group-audit-events)

• Group Owner and above: read all group-level audit events
• Developer and Maintainer: read their own group-level audit events

Project-level audit events (https://docs.gitlab.com/ee/api/audit_events.html#project-audit-events)

• Project Maintainer and above: read all project-level audit events
• Developer: read their own project-level audit events

We will roll out this permission changes to the UI in a separate MR.

⚙️ Implementation

• Introduce 2 new permissions read_project_audit_events and read_group_audit_events to Developer role.
• In API, enforce filter by author_id using current_user when applicable.

🐘 Database

This MR introduces an extra filter author_id. Fortunately, we already have a DB index on this field.

SELECT
    "audit_events".*
FROM
    "audit_events"
WHERE
    "audit_events"."entity_type" = 'Group'
    AND "audit_events"."entity_id" = 9970
    AND "audit_events"."author_id" = 4438191
ORDER BY
    "audit_events"."id" DESC
LIMIT
    20 OFFSET 0

Time: 89.363 ms
  - planning: 0.340 ms
  - execution: 89.023 ms
    - I/O read: 88.242 ms
    - I/O write: 0.000 ms

Shared buffers:
  - hits: 0 from the buffer pool
  - reads: 26 (~208.00 KiB) from the OS file cache, including disk I/O
  - dirtied: 0
  - writes: 0

https://explain.dalibo.com/plan/ftz

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers
• [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• Label as security and @ mention @gitlab-com/gl-security/appsec
• [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team

Related to #257514 (closed)