This avoids needing to special case policy checks against a hash, and
is part of a larger MR that requires GraphQL objects to respond to
authorization checks more uniformly.

See: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/40088)