add everywhere read-only access mode for users

[Md-Cake]

this might be useful for some system users like teamcity agents: they need to be able to pull changes in all repositories without having possibility to modify anything