Prevent users from logging hours system wide

[#1]

Admin ability to prevent all users, or a subset, from being able to log hour entries in the system.

Use case - we're updating job role cost rates across the system. There's a period of time where we need users to create Billing Records and add all project hours to them. We then update all job role cost rates. We don't want users being able to add net new hour entries while all of this is taking place. An easy way for the admin to lock hour entry functionality would be super helpful. Doing this by updating sharing settings, per project, without preventing users from still having proper access to projects to do other actions, is too big a lift.