Use read permissions for DAST GraphQL types

What does this MR do?

This changes the permissions used in the DAST types to the read_ abilities, rather than the create_ abilities.

Happily, these are equivalent at the moment, so this is not a breaking change.

Rationale:

Object types should use read permissions, mutations should use creation/update/delete permissions.

This change was made during work on !40088 (merged) and can be safely extracted.

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.