Make read:org permissions optional / dependent upon whether `allowOrgs` is specified

Created by: slimsag

A customer https://app.hubspot.com/contacts/2762526/company/768958849/ was surprised when they upgraded to 3.12 and it required new undocumented read:org permissions, which I corrected in https://github.com/sourcegraph/sourcegraph/pull/8101

They use GHE, though, and not GitHub.com where the allowOrgs setting would be useful -- and are hesitant to upgrade because of these new permission requirements. Questions:

Questions for @sourcegraph/core-services :

1. How hard would it be for us to make read:org permissions dependent upon whether the allowOrgs property is set, or whether or not GHE is in use, or something like that? (i.e. opt-in)
2. Assuming it is possible and there aren't implications I am not thinking of, can we commit to doing this in a specific release (so I can let them know)?

Note: I think this type of permission opt-in would generally be beneficial as we require new code host permissions in the future, as we have seen this be a mild hurdle within some organizations where changes in permissions like this require sign off from different teams, etc. I am proposing this not for a specific customer but rather because it would be beneficial for most, I believe.