Allow Releases to be published without giving access to source code

What does this MR do and why?

Decouple Releases permissions from Repository, so that Releases can be public when Repository is private. This builds on the new Releases feature toggle that was rolled out in !99045 (merged).

Related to #216485 (closed)

Screenshots or screen recordings

The video is a bit blurry as I had to compress it to be under 10MB.

Screen_Recording_2022-10-05_at_6.14.47_PM__480p_

How to set up and validate locally

1. Create a public project
2. In project settings, set Repository to "Only project members"
3. In project settings, ensure that Releases is enabled for "Everyone with access"
4. Create a release
5. You should be able to browse the project's releases as a non-member, and have no access to the repository

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.