MM-14439: experimental restrict system admin (#10414)

* api4: break out license and config from system

* app: move some config functions from admin.go to config.go

* add ExperimentalSettings.RestrictSystemAdmin

* forbid various actions to restricted system admin

* update default.json

* fix function names in errors

config/default.json

@@ -359,7 +359,8 @@
         "ClientSideCertEnable": false,
         "ClientSideCertCheck": "secondary",
         "DisablePostMetadata": false,
-        "LinkMetadataTimeoutMilliseconds": 5000
+        "LinkMetadataTimeoutMilliseconds": 5000,
+        "RestrictSystemAdmin": false
     },
     "AnalyticsSettings": {
         "MaxUsersForStatistics": 2500