campaigns: add a site configuration flag to disable admin fallback to site-wide code host tokens

Created by: LawnGnome

Currently, when a site admin applies a campaign that publishes changesets, the reconciler will fall back to the global token if the site admin doesn't have a PAT configured for that code host. This makes migrating from older versions of Sourcegraph easier, but it's likely that some sites will want to disable this behaviour. (In the longer term, we may also want to make the default here to disable that fallback.)

Implementing this would require a site configuration setting to be added and this check to be extended to check it: if the configuration disallows fallback, then this return nil, nil should return an error instead.

When implementing this, we should also consider our overall configuration schema here, since we also have #17919 (closed) on our roadmap. We want to ensure that we don't allow nonsensical combinations (only use a bot user, but don't fall back to global tokens).