Disable public worker pools at the account/space level

## Requested Solution

Add an account-level (and optionally space-level) toggle: **"Disable public worker pools."** When enabled:

- Stacks without a `worker_pool_id` cannot trigger runs; they fail immediately with a clear error message before reaching any worker
- The Spacelift UI hides or disables the "use public workers" option when creating/editing stacks
- API and Terraform provider calls that create or update a stack without a `worker_pool_id` are rejected

This should be inheritable: setting it at a parent space cascades to all children, matching the existing space-based RBAC model.

---

## Use Case

Our organization requires all Terraform execution to occur on internally-managed private worker pools for security and compliance. Today, this requires writing and maintaining an OPA/Rego PLAN policy, attaching it to the correct space, and accepting that the policy only fires after `terraform plan` has already executed on the public runner. A misconfigured or newly-created stack silently defaults to public runners with no preventive guardrail. A simple toggle would eliminate the need for policy-based workarounds entirely.

---

## Priority

High. This is a blocker for enterprise customers with private infrastructure mandates.