feat(enterprise): implement organization "disable workspace sharing" option (#21376)

Adds a per-organization setting to disable workspace sharing. When enabled,
all existing workspace ACLs in the organization are cleared and the workspace
ACL mutation API endpoints return `403 Forbidden`.

This complements the existing site-wide `--disable-workspace-sharing` flag by
providing more granular control at the organization level.

Closes https://github.com/coder/internal/issues/1073 (part 2)

---------

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>

enterprise/coderd/coderd.go

@@ -361,6 +361,14 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 
 				r.Get("/idpsync/available-fields", api.organizationIDPSyncClaimFields)
 				r.Get("/idpsync/field-values", api.organizationIDPSyncClaimFieldValues)
+
+				r.Route("/workspace-sharing", func(r chi.Router) {
+					r.Use(
+						httpmw.RequireExperiment(api.AGPL.Experiments, codersdk.ExperimentWorkspaceSharing),
+					)
+					r.Get("/", api.workspaceSharingSettings)
+					r.Patch("/", api.patchWorkspaceSharingSettings)
+				})
 			})
 		})