MM-14439: experimental restrict system admin (#10414)

* api4: break out license and config from system

* app: move some config functions from admin.go to config.go

* add ExperimentalSettings.RestrictSystemAdmin

* forbid various actions to restricted system admin

* update default.json

* fix function names in errors

api4/cluster_test.go

@@ -5,19 +5,32 @@ package api4
 
 import (
 	"testing"
+
+	"github.com/mattermost/mattermost-server/model"
 )
 
 func TestGetClusterStatus(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()
 
-	_, resp := th.Client.GetClusterStatus()
-	CheckForbiddenStatus(t, resp)
+	t.Run("as system user", func(t *testing.T) {
+		_, resp := th.Client.GetClusterStatus()
+		CheckForbiddenStatus(t, resp)
+	})
 
-	infos, resp := th.SystemAdminClient.GetClusterStatus()
-	CheckNoError(t, resp)
+	t.Run("as system admin", func(t *testing.T) {
+		infos, resp := th.SystemAdminClient.GetClusterStatus()
+		CheckNoError(t, resp)
 
-	if infos == nil {
-		t.Fatal("should not be nil")
-	}
+		if infos == nil {
+			t.Fatal("should not be nil")
+		}
+	})
+
+	t.Run("as restricted system admin", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ExperimentalSettings.RestrictSystemAdmin = true })
+
+		_, resp := th.SystemAdminClient.GetClusterStatus()
+		CheckForbiddenStatus(t, resp)
+	})
 }