This reverts commit 426716d1

[11.4] Do not expose trigger token when user should not see it

See merge request gitlab/gitlabhq!2761

(cherry picked from commit bc660b08642de2a68e39a443566e7665f057a0a8)

1b81cbce Do not expose trigger token when user should not see it

Enables frozen string for some vestigial files as
well as the following:

* app/controllers/projects/**/*.rb
* app/controllers/sherlock/**/*.rb
* app/controllers/snippets/**/*.rb
* app/controllers/users/**/*.rb

Partially addresses #47424.

Add a rubocop rule to check if a method 'redirect_to' is used without explicitly set 'status' in 'destroy' actions of controllers

Also updated the #update action inside the variables controller as
to render the show and not redirect back to the settings route

Added tests to verify the access policy to the new controller

This MR simplifies CI permission model:
- read_build: allows to read a list of builds, artifacts and trace
- update_build: allows to cancel and retry builds
- create_build: allows to create builds from gitlab-ci.yml (not yet implemented)
- admin_build: allows to manage triggers, runners and variables
- read_commit_status: allows to read a list of commit statuses (including the overall of builds)
- create_commit_status: allows to create a new commit status using API

Remove all extra methods to manage permission.
Made all controllers to use explicitly the new permissions.

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>