The policies got introduced in:
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/88245
but they were not used in controllers to check access.

To avoid confusion, this makes use of the policies.