fix: resolve actions commit status permission per repository (#38977)

Various pages did not display the correct action run list tooltips. Fix
those tooltips like here on the `/pulls` page:

`ctx.Repo.Permission` is the zero value outside a repository route, so
on `/pulls`, `/issues`, `/notifications/subscriptions` and the dashboard
repo list the commit status "Details" link was always stripped. The live
job status is looked up from that target URL, so running checks also
rendered as a static pending dot instead of a spinner.

Resolve the Actions unit permission per repository instead.

Also drops the releases page's gate on *loading* statuses, which hid
external CI results from anyone without Actions read; it now loads them
and hides only the URL, like every other page.

Co-authored-by: bircni <bircni@icloud.com>

routers/web/repo/release.go

@@ -97,11 +97,12 @@ func getReleaseInfos(ctx *context.Context, opts *repo_model.FindReleasesOptions)
 	}
 	var ok bool
 
-	canReadActions := ctx.Repo.Permission.CanRead(unit.TypeActions)
+	// statuses describe the tagged code, and unlike the other pages showing them this one is not behind the code unit
+	canReadCode := ctx.Repo.Permission.CanRead(unit.TypeCode)
 
 	// Bulk-load commit statuses for all releases in one query.
 	var commitStatusMap map[string][]*git_model.CommitStatus
-	if canReadActions && len(releases) > 0 {
+	if canReadCode && len(releases) > 0 {
 		shas := make([]string, 0, len(releases))
 		for _, r := range releases {
 			shas = append(shas, r.Sha1)
@@ -140,8 +141,9 @@ func getReleaseInfos(ctx *context.Context, opts *repo_model.FindReleasesOptions)
 			Release: r,
 		}
 
-		if canReadActions {
+		if canReadCode {
 			statuses := commitStatusMap[r.Sha1]
+			git_model.CommitStatusesApplyDoerPermission(ctx, ctx.Doer, statuses)
 			info.CommitStatus = git_model.CalcCommitStatus(statuses)
 			info.CommitStatuses = statuses
 		}