Alerting: Update rule access control to explicitly check for permissions "alert.rules:read" and "folders:read" (#78289)

* require "folders:read" and "alert.rules:read"  in all rules API requests (write and read). 

* add check for permissions "folders:read" and "alert.rules:read" to AuthorizeAccessToRuleGroup and HasAccessToRuleGroup

* check only access to datasource in rule testing API

---------

Co-authored-by: William Wernert <william.wernert@grafana.com>

pkg/tests/api/alerting/api_alertmanager_test.go

@@ -614,7 +614,7 @@ func TestIntegrationRulerAccess(t *testing.T) {
 			desc:            "viewer request should fail",
 			client:          newAlertingApiClient(grafanaListedAddr, "viewer", "viewer"),
 			expStatus:       http.StatusForbidden,
-			expectedMessage: `You'll need additional permissions to perform this action. Permissions needed: any of alert.rules:write, alert.rules:create, alert.rules:delete`,
+			expectedMessage: `You'll need additional permissions to perform this action. Permissions needed: all of alert.rules:read, folders:read, any of alert.rules:write, alert.rules:create, alert.rules:delete`,
 		},
 		{
 			desc:            "editor request should succeed",

pkg/tests/api/alerting/api_backtesting_test.go

@@ -125,7 +125,7 @@ func TestBacktesting(t *testing.T) {
 
 		t.Run("fail if can't query data sources", func(t *testing.T) {
 			status, body := testUserApiCli.SubmitRuleForBacktesting(t, queryRequest)
-			require.Contains(t, body, "user is not authorized to access rule group")
+			require.Contains(t, body, "user is not authorized to access one or many data sources")
 			require.Equalf(t, http.StatusForbidden, status, "Response: %s", body)
 		})
 	})