feat: add organization setting to restrict project-scoped contracts (#2602)

Signed-off-by: Sylwester Piskozub <[email protected]>

Author: Piskoo

app/controlplane/api/controlplane/v1/organization.pb.go

@@ -96,6 +96,9 @@ message OrganizationServiceUpdateRequest {
 
   // prevent workflows and projects from being created implicitly during attestation init
   optional bool prevent_implicit_workflow_creation = 5;
+
+  // restrict_contract_creation_to_org_admins restricts contract creation (org-level and project-level) to only organization admins (owner/admin roles)
+  optional bool restrict_contract_creation_to_org_admins = 6;
 }
 
 message OrganizationServiceUpdateResponse {

app/controlplane/api/controlplane/v1/organization.proto

@@ -281,6 +281,8 @@ message OrgItem {
   repeated string policy_allowed_hostnames = 5;
   // prevent workflows and projects from being created implicitly during attestation init
   bool prevent_implicit_workflow_creation = 7;
+  // restrict_contract_creation_to_org_admins restricts contract creation (org-level and project-level) to only organization admins (owner/admin roles)
+  bool restrict_contract_creation_to_org_admins = 8;
 
   enum PolicyViolationBlockingStrategy {
     POLICY_VIOLATION_BLOCKING_STRATEGY_UNSPECIFIED = 0;