Ensures audit events are visible to auditor

Changelog: fixed
EE: true

ee/app/controllers/projects/audit_events_controller.rb

@@ -43,6 +43,8 @@ class Projects::AuditEventsController < Projects::ApplicationController
   end
 
   def filter_by_author(params)
-    can?(current_user, :admin_project, project) ? params : params.merge(author_id: current_user.id)
+    return params if can?(current_user, :admin_project, project) || current_user.auditor?
+
+    params.merge(author_id: current_user.id)
   end
 end

ee/app/policies/ee/project_policy.rb

@@ -276,6 +276,7 @@ module EE
         enable :read_environment
         enable :read_deployment
         enable :read_pages
+        enable :read_project_audit_events
       end
 
       rule { ~security_and_compliance_disabled & auditor }.policy do

ee/spec/policies/project_policy_spec.rb

@@ -47,6 +47,7 @@ RSpec.describe ProjectPolicy do
         read_software_license_policy
         read_threat_monitoring read_merge_train
         read_release
+        read_project_audit_events
       ]
     end