instance policy to restrict community creation to selected users (closed education instances)

This is now available on self-hosted instances as of #3055.. In the admin panel, go to "Instance config" → "Community creation" and set "Who can create communities" to "Restricted". From then on, only admins with the wildcard ACL and users matched by a limit rule that grants "Community Creation Access" can create communities. Everyone else gets a "You don't have permission to create communities on this instance" error, enforced server-side. To let specific people create communities, give those users a trait on their admin user page, then add a rule under "Limit config" that matches that trait and turns on "Community Creation Access".