Align permissions for Workspace-like GuardedResources so people can access prebuilds in all scenarios

[geropl]

So far in some cases, you might be presented with this screen when waiting for a prebuild:

We should ensure that we share the same logic between:
a) the places where we decided someone is eligible to receive a prebuild with
b) where we decide that people are able to access the required resources