Non-project repository starting restrictions

[filiptronicek]

Description

Allow org owners to limit roles which can start workspaces from repositories that have not been imported.

Related Issue(s)

Fixes ENT-816

How to test

1. Join my org
2. Try to start any workspace
3. Import the same repo under Repository settings
4. Try it again (should work now)

[mustard-mh]

Tested it works as How to Test section described, but maybe we could improve by:

• Only show projects if they're restricted instead of let workspace failed to start with an errored workspace left on dashboard
• If restricted users could go import projects, then it feels like it's not a really restriction? (it behaviors similar with editor restriction but feels different).

ws list	ws detail

[mustard-mh]

And UI when there's no roles has start any repos permission

[filiptronicek]

Only show projects if they're restricted instead of let workspace failed to start with an errored workspace left on dashboard

Definitely agree, let's not suggest them when they're restricted.

If restricted users could go import projects, then it feels like it's not a really restriction? (it behaviors similar with editor restriction but feels different).

This is mostly targeted against the Collaborator role, but we made it a bit more flexible. I don't feel like it's not a restriction, the same way you could have a restriction on an expensing system which would force you to have receipts for every expense you want to submit.

[mustard-mh]

Works as expected

One last nit (not-blocker): users restricted can still try to create workspace by copy-paste or browser-extension, and then it will add a failed workspace as well. Maybe we could do permission check before create workspace?