[v3-3-test] Clarify that AccessView.JOBS is the Edge worker management permission (#72627) - #73072

…t permission (#72627)

The Edge UI plugin docs say that "can read on Plugins" and "can read on
Jobs" let you view the UI and manage the workers, but they do not say how
the two permissions differ, and they do not mention what the default
Viewer role already holds.

Both gaps matter, because the endpoints and the navigation are gated
differently:

- The worker management endpoints under /edge_worker/ui/ check only
  AccessView.JOBS, and the check is not method-aware -- the same
  dependency guards the GET reads and the POST/PATCH/DELETE mutations.
- "can read on Plugins" only controls whether the plugin shows up in the
  UI navigation. It is not required in order to call the endpoints.

So "can read on Jobs" alone is enough to shut down, delete, re-queue and
retune Edge workers, whether or not the plugin is visible to that user.

That is intentional -- AccessView.JOBS is the management permission for
the plugin rather than a read-only grant -- but it reads as surprising
from the code alone, where a permission named "can read" guards mutating
routes. It is more surprising in a default Flask AppBuilder setup, where
the Viewer role includes (ACTION_CAN_READ, RESOURCE_JOB) but not the
Plugins read: such a user cannot see the Edge plugin and can still reach
its management endpoints.

Adds a warning to the UI plugin docs stating the intent, the split
between the two permissions, the consequence for the default Viewer role,
and the concrete action for deployments where Viewers must not manage
workers. Points at the existing "fine granular access control" entry in
architecture.rst rather than restating it.

Documentation only; no behaviour change.
(cherry picked from commit 1391b09)

Co-authored-by: Jarek Potiuk <[email protected]>