Tweaks to policy manager

Explicitly disable scheduler enable/disable and do not forbid
rest of the actions. This way we work around weird issue with
us not being able to cancel queue of tasks.

master.cfg

@@ -374,9 +374,12 @@ authz = util.Authz(
         # Defaulting old config, everyone can stop build.
         util.StopBuildEndpointMatcher(role="stranger"),
         util.ForceBuildEndpointMatcher(role="stranger"),
+        util.RebuildBuildEndpointMatcher(role="stranger"),
+        util.EnableSchedulerEndpointMatcher(role="admins"),
 
         # if future Buildbot implement new control, we are safe with this last rule
-        util.AnyControlEndpointMatcher(role="admins")
+        # NOTE: This prevents us from cancelling queue, so disabled for now.
+        # util.AnyControlEndpointMatcher(role="admins")
     ],
     roleMatchers=[
         RolesFromOwner(role="owner"),