Sharing controls

Restrict who can share team VMs publicly or with external users

By default, any team member can share their VMs publicly or with people
outside the team. Admins can lock this down so that only admins (and the
billing owner) decide how broadly team VMs are exposed.

## Viewing settings

Run `team settings` to see the current sharing mode:

```
team settings
```

```
Team settings:
  vm-sharing: all-members
```

## Changing the sharing mode

Only team admins and the billing owner can change sharing settings:

```
team settings vm-sharing <admins-only|all-members>
```

There are two modes:

- **`all-members`** (default). Any team member can make a VM public
  (`share set-public`) and share it with external email addresses
  (`share add <vm> <email>`).
- **`admins-only`**. Regular members can no longer make VMs public or share
  them with people outside the team. Only admins and the billing owner can.

Switching to `admins-only`:

```
team settings vm-sharing admins-only
```

Sharing a VM with the whole team (`share add <vm> team`) and SSH/Shelley
access (`share access allow`) are unaffected by this setting.

See the [sharing docs](/docs/sharing) for how the underlying share
mechanisms work, and [Team VMs](/docs/teams/vms) for team-scoped sharing.