MM-14439: experimental restrict system admin (#10414)

* api4: break out license and config from system

* app: move some config functions from admin.go to config.go

* add ExperimentalSettings.RestrictSystemAdmin

* forbid various actions to restricted system admin

* update default.json

* fix function names in errors

model/config.go

@@ -713,6 +713,7 @@ type ExperimentalSettings struct {
 	ClientSideCertCheck             *string
 	DisablePostMetadata             *bool
 	LinkMetadataTimeoutMilliseconds *int64
+	RestrictSystemAdmin             *bool
 }
 
 func (s *ExperimentalSettings) SetDefaults() {
@@ -731,6 +732,10 @@ func (s *ExperimentalSettings) SetDefaults() {
 	if s.LinkMetadataTimeoutMilliseconds == nil {
 		s.LinkMetadataTimeoutMilliseconds = NewInt64(EXPERIMENTAL_SETTINGS_DEFAULT_LINK_METADATA_TIMEOUT_MILLISECONDS)
 	}
+
+	if s.RestrictSystemAdmin == nil {
+		s.RestrictSystemAdmin = NewBool(false)
+	}
 }
 
 type AnalyticsSettings struct {