Merge branch '391551-deploy-token-policy-scope-update' into 'master'

Do not cache container_registry_disabled policy

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/143021



Merged-by: David Fernandez <dfernandez@gitlab.com>
Approved-by: Alex Buijs <abuijs@gitlab.com>
Approved-by: Adie (she/her) <avpfestin@gitlab.com>
Approved-by: David Fernandez <dfernandez@gitlab.com>
Reviewed-by: David Fernandez <dfernandez@gitlab.com>
Co-authored-by: Jaime Martinez <jmartinez@gitlab.com>

app/policies/project_policy.rb

@@ -67,7 +67,10 @@ class ProjectPolicy < BasePolicy
   condition(:default_issues_tracker, scope: :subject) { project.default_issues_tracker? }
 
   desc "Container registry is disabled"
-  condition(:container_registry_disabled, scope: :subject) do
+  # Do not use the scope option here as this condition depends
+  # on both the user and the subject, and can lead to bugs like
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/391551
+  condition(:container_registry_disabled) do
     if user.is_a?(DeployToken)
       (!user.read_registry? && !user.write_registry?) ||
       user.revoked? ||