Introduce conditional `DisableIf` generator & read-only mode

[max-moser]

This can be used to implement a conditional read-only mode, e.g. enabled temporarily to make system migrations smoother.

To do:

• [x] add some tests for the new generators and configuration items

[fenekku]

Coordination:

This one has been sitting for 3weeks+

Surfacing this back to attention for @utnapischtim , @ppanero and @ntarocco . If someone else would be better suited to look at it, let us know!

[chokribr]

@utnapischtim @ppanero please take a look!

[max-moser]

Given that Mr. E already provided the ConditionalGenerator, I reworked this PR to be based off that instead. Over the course of that, the functionality of having the config option a callable got thrown out the window.

Given that we override most of the permission policies in our own modules anyway, we can add that feature in locally for us.