feat(enterprise): implement organization "disable workspace sharing" option (#21376)

Adds a per-organization setting to disable workspace sharing. When enabled,
all existing workspace ACLs in the organization are cleared and the workspace
ACL mutation API endpoints return `403 Forbidden`.

This complements the existing site-wide `--disable-workspace-sharing` flag by
providing more granular control at the organization level.

Closes https://github.com/coder/internal/issues/1073 (part 2)

---------

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>

codersdk/workspacesharing.go

@@ -0,0 +1,43 @@
+package codersdk
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+)
+
+// WorkspaceSharingSettings represents workspace sharing settings for an organization.
+type WorkspaceSharingSettings struct {
+	SharingDisabled bool `json:"sharing_disabled"`
+}
+
+// WorkspaceSharingSettings retrieves the workspace sharing settings for an organization.
+func (c *Client) WorkspaceSharingSettings(ctx context.Context, orgID string) (WorkspaceSharingSettings, error) {
+	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/organizations/%s/settings/workspace-sharing", orgID), nil)
+	if err != nil {
+		return WorkspaceSharingSettings{}, err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		return WorkspaceSharingSettings{}, ReadBodyAsError(res)
+	}
+	var resp WorkspaceSharingSettings
+	return resp, json.NewDecoder(res.Body).Decode(&resp)
+}
+
+// PatchWorkspaceSharingSettings modifies the workspace sharing settings for an organization.
+func (c *Client) PatchWorkspaceSharingSettings(ctx context.Context, orgID string, req WorkspaceSharingSettings) (WorkspaceSharingSettings, error) {
+	res, err := c.Request(ctx, http.MethodPatch, fmt.Sprintf("/api/v2/organizations/%s/settings/workspace-sharing", orgID), req)
+	if err != nil {
+		return WorkspaceSharingSettings{}, err
+	}
+
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return WorkspaceSharingSettings{}, ReadBodyAsError(res)
+	}
+	var resp WorkspaceSharingSettings
+	return resp, json.NewDecoder(res.Body).Decode(&resp)
+}