In #16252 it was discovered that template admins aren't allowed to cancel template dry-run jobs, nor workspace build jobs.

This is due to:

And en explanation for it exists here:

I'm not sure the explanation makes sense, though, at least not for template version dry runs.

We should reconsider the RBAC requirements for cancellation. A template admin may very well need to cancel a workspace build as well.