enable or disable guest sessions for this workspace

Guests are people the identity provider authenticates who have no Windmill account; the guest app execution mode admits them. Off by default. Re-read where a guest session is minted and at the auth door on every guest request, so turning it off takes effect immediately, for sessions already issued and for apps whose policy already says guest.