Introduce a template-scoped setting that allows or disables non-template-admin users from selecting a specific template version on their workspace.

When disabled, all workspaces are built with the latest promoted template version. It also overrides and disables workspace-level controls opting in or out of automatic updates on autostart: all workspaces from the template behave as if automatic updates are enabled.

When enabled, users can select the version they would like to use for builds, and they can opt in or opt out of the automatic updates.

These restrictions do not apply to template admins: they can always select the version for builds, regardless of this setting. This is so that they can test new template versions prior to promoting them.

This issue is scoped to the database changes, backend, APIs, and behavior. A separate issue will expose the setting on the front end.