portfolio access control should be a configuration property

### Current Behavior

The "portfolio access control" is switchable at runtime (using the UI or the REST-API).

### Proposed Behavior

Enabling or disabling the "portfolio access control" should be an initial decision that is only configurable in the API server backend.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested