Adapt PAT Finder to use policy instead of `admin?`

What does this MR do and why?

I'm tackling !58530 (closed) and trying to reduce the scope. This MR changes the PersonalAccessTokensFinder to use the policy instead of admin?. And in the course of the change I also tried to refactor the specs.

• Related issue: #207950
• Similar MR: !105006 (merged)

🛠 with ❤ at Siemens

/cc @bufferoverflow

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.