Connect action is missing from resource detail pages for researchers

Description

A resource with a valid connection_uri displays Connect on its list card, but the same action can be missing from the resource detail page for a Workspace Researcher.

This was observed with a pooled Azure Virtual Desktop workspace service, but the cause is in the shared resource UI rather than the AVD template.

Current behavior

• ResourceCard displays Connect when connection_uri is present.
• On the detail page, ResourceHeader renders connection and management actions through ResourceContextMenu.
• The shared context menu is restricted to resource owners/administrators because it also contains Update, Disable, and Delete.
• A Workspace Researcher can therefore connect from the list card but has no Connect action after opening the resource details.

Expected behavior

Users who can access a resource should be able to use its external connection URI consistently from both the list card and the detail page. Management actions must remain restricted to the existing owner/administrator roles.

Suggested approach

Render Connect as a separate detail-header action, independently of the owner-only management menu. Keep Update, Disable, and Delete under the existing authorization rules. Use the same connection eligibility rules as the list card, including connection_uri and is_exposed_externally behavior.

Steps to reproduce

1. Deploy a workspace service that returns a valid external connection_uri (for example, a pooled AVD service).
2. Sign in as a Workspace Researcher who is not the resource owner.
3. Confirm that Connect appears on the resource list card.
4. Open the resource detail page.
5. Observe that no Connect action is available.

Acceptance criteria

• Workspace Researchers can use Connect from a resource detail page when the resource exposes a valid external connection_uri.
• Connect behavior is consistent between list cards and detail pages.
• Update, Disable, and Delete remain restricted to their current authorized roles.
• Resources without an eligible connection URI do not display Connect.
• Automated UI tests cover researcher and owner behavior.

Locate ResourceCard, ResourceHeader, and ResourceContextMenu, then compare the detail-page action path with the list-card connection eligibility logic. Add automated UI coverage for Workspace Researchers and owners, including eligible and ineligible connection_uri cases. Done means Connect is available consistently while Update, Disable, and Delete retain their current restrictions.