feat: add deployment-wide option to disable workspace sharing (#21172)

Adds `--disable-workspace-sharing` option.

Workspace sharing is disabled by not including user and group ACLs in
the workspace RBAC object, which prevents ACL-based authz.

Closes https://github.com/coder/internal/issues/1072

The commit also adds saving of workspace user/group ACLs in the test DB
data generator.

coderd/apidoc/docs.go

@@ -14214,6 +14214,9 @@ const docTemplate = `{
                 "disable_path_apps": {
                     "type": "boolean"
                 },
+                "disable_workspace_sharing": {
+                    "type": "boolean"
+                },
                 "docs_url": {
                     "$ref": "#/definitions/serpent.URL"
                 },

coderd/apidoc/swagger.json

@@ -12798,6 +12798,9 @@
 				"disable_path_apps": {
 					"type": "boolean"
 				},
+				"disable_workspace_sharing": {
+					"type": "boolean"
+				},
 				"docs_url": {
 					"$ref": "#/definitions/serpent.URL"
 				},