Plugins Catalog: Only allow admins to access plugins catalog (#57101)

* feat(plugins-catalog): only allow admins to access plugins catalog routes

* add backend check

* fix(plugins-catalog): update route role access to include server admins

Co-authored-by: Will Browne <will.browne@grafana.com>

pkg/middleware/auth.go

@@ -10,6 +10,7 @@ import (
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/middleware/cookies"
 	"github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/services/auth"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/org"
@@ -86,6 +87,15 @@ func EnsureEditorOrViewerCanEdit(c *models.ReqContext) {
 	}
 }
 
+func CanAdminPlugins(cfg *setting.Cfg) func(c *models.ReqContext) {
+	return func(c *models.ReqContext) {
+		if !plugins.ReqCanAdminPlugins(cfg)(c) {
+			accessForbidden(c)
+			return
+		}
+	}
+}
+
 func RoleAuth(roles ...org.RoleType) web.Handler {
 	return func(c *models.ReqContext) {
 		ok := false