[ui] Read-based checks for viewing templates and write-based checks for saving them

[philrenaud]

This adds nuance to the ACL policy checks for a user to be able to see Job Templates (which are specifically-named Nomad Variables behind the scenes).

The way it works today has some specific checks in place:

• to even get into the job templates section, you have to first click the "Run Job" button, which only exists if you have the submit-job ACL capability, or a general "write" policy.
• Once there, we only show you a "Choose from template" button if you can write variables to *.

I think the original intent here was to do up-front checks for full CRUD access, but this PR moves that access check a little downstream. Here, you'll see that the check to see the "Choose from template" button requires specifically read variable access (and I could be convinced to make it list variables, but that would make the subsequent page pretty useless), and the write variable check is moved downstream to the "save as template" button, and to manually edit a given job template via the Management page.

Here is a sample ACL policy to test with:

namespace "default" {
  policy = "read"
  capabilities = ["submit-job"]
  variables {
    # give read access to all job templates related to this namespace
    path "nomad/job-templates/*" {
      capabilities = ["read","list","write"]
    }
    path "*" {
      capabilities = ["write","list"]
    }
  }
}

^--- the submit-job capability is in place, so the "Run Job" button will be present. Also, the nomad/job-templates/* rule has both read and write, which will show both a "Choose from template" and a "Save as template" button. Remove either read or write to see how buttons disappear accordingly.

User has read and write, but not delete, variable capability:

User has read variables for nomad/job-templates/*:

User has write variables for nomad/job-templates/*:

Resolves #23438

[github-actions]

Ember Test Audit comparison

	main	e05c580	change
passes	1573	1573	0
failures	0	0	0
flaky	0	0	0
duration	11m 32s 421ms	11m 24s 155ms	-08s 266ms

[tgross]

LGTM! 👍

[tgross]

At first glance I thought this would get us into trouble, but the write policy for Variables is a little different than it is for anything else:

Create or update Variables at this path. Includes the "list" capability but not the "read" or "destroy" capabilities.

👍