Add permission to block access to the web app

What does this MR do?

This adds a new permission to completely block access to the web application for users.

It came up while building https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18570.

It's not strictly necessary, we could just have a before filter that just checks the terms, but I think it makes sense to have this permission, similarly to how we have this kind of thing for the API and git access.

That way we can prevent one permission for blocked users, we can also use this for the terms, but there will be another filter before new one that will redirect to the terms.

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Documentation created/updated
• API support added
• Tests added for this feature/bug
• Review
  • Has been reviewed by UX
  • Has been reviewed by Frontend
  • Has been reviewed by Backend
  • Has been reviewed by Database
• Conform by the merge request performance guides
• Conform by the style guides
• Squashed related commits together
• Internationalization required/considered
• End-to-end tests pass (package-and-qa manual pipeline job)

What are the relevant issue numbers?

Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/44798