Cache upload access controls

Teams can now choose who is allowed to upload cache artifacts from the account Cache page. Keep uploads open to members, CI, and account tokens, or switch to CI and account tokens only so developers can keep downloading trusted cache artifacts without publishing local branch builds back into the cache.

This is useful when CI is your trusted cache producer. CI OIDC logins and scoped account tokens can write to the cache, while members using normal login sessions stay read-only. That helps teams avoid one-off local uploads, reduce cache storage growth, and remove upload wait time from developer machines.