Introduce conditional DisableIf generator & read-only mode

[max-moser]

This can be used to implement a conditional read-only mode, e.g. enabled temporarily to make system migrations smoother.

To do:

• add some tests for the new generators and configuration items

[fenekku]

Coordination:

This one has been sitting for 3weeks+

Surfacing this back to attention for @utnapischtim , @ppanero and @ntarocco . If someone else would be better suited to look at it, let us know!

[ntarocco]

LGTM! It would be even better to add a test for a service:

RECORDS_PERMISSIONS_READ_ONLY = True

with PermissionDenied:
    service.update(record, "owner", data)

[chokribr]

@utnapischtim @ppanero please take a look!

[max-moser]

Given that Mr. E already provided the ConditionalGenerator, I reworked this PR to be based off that instead.
Over the course of that, the functionality of having the config option a callable got thrown out the window.

Given that we override most of the permission policies in our own modules anyway, we can add that feature in locally for us.