This prevents non-admins from creating Jira Connect namespace
subscriptions.

This additional check is controlled by a new ops feature flag
(`jira_connect_require_site_admins`) so that it can be disabled
for self-hosted installations if required.

Changelog: security