Maintainers should be able to apply install/script automations from the UI

[iansltx]

Fleet version: 4.57.0+ (installs), 4.58.0+ (scripts)

---

💥  Actual behavior

Per @RachelElysia's comment, maintainers can't set policy automations for software installs or script runs in the UI, though they can in the API. Per today's design review outcome, the API permission is the reasonable one here, so we should match that in the UI.

🧑‍💻  Steps to reproduce

1. Add a policy to a team
2. While logged in as a Maintainer, observe that policy automations on the team are unavailable

🛠️ To fix

Show the policy automation drop-down in team-specific view, containing script and install automation options, for Maintainers, subject to the gating we do by license type.

[RachelElysia]

Please add your planning poker estimate with Zenhub @jacobshandling

[RachelElysia]

Add quick test if time allows

[RachelElysia]

I just tested this manually, maintainers have access to the API for install software and run script but not for calendar events and other workflows (errors: [{name: "base", reason: "forbidden"}].

I'm thinking for maintainers, we should show to the dropdown but disable calendar events and other workflows with a tooltip OR we should remove calendar events and other workflows from the dropdown.

wdyt? @rachaelshaw / @noahtalerman

Visual of admin dropdown and what works for maintainers and what doesnt:

[RachelElysia]

Adding this to my plate since I think we should get this into 4.60 major release as we are preventing major flows for maintainers in the UI that are available in the API.

[rachaelshaw]

Here's the permissions we have documented, looks like this doesn't quite match up with what @RachelElysia found (says maintainers can manage calendar events):

[iansltx]

@rachaelshaw Calendar events permissions mismatch is covered in #23483. The issue there is that the current modal covers both things that a maintainer is allowed to do (toggling per policy) and things that require an admin (setting the web hook and turning on/off calendar integrations entirely).

[RachelElysia]

Check other workflows APIs if maintainer has access to either of them

[RachelElysia]

@rachaelshaw decide if we should try to fix in 4.60

[RachelElysia]

related to #23483