Restricted cloud settings (#15528)

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/system.go

@@ -270,6 +270,11 @@ func getLogs(c *Context, w http.ResponseWriter, r *http.Request) {
 	auditRec := c.MakeAuditRecord("getLogs", audit.Fail)
 	defer c.LogAuditRec(auditRec)
 
+	if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin {
+		c.Err = model.NewAppError("getLogs", "api.restricted_system_admin", nil, "", http.StatusForbidden)
+		return
+	}
+
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_REPORTING) {
 		c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_REPORTING)
 		return