Fix a policy issue where permissions were not properly checked when disabling global builtin queries

Summary: See https://hackerone.com/reports/1573143. The pathway for disabling global builtin queries is missing a policy check. Add it.

Test Plan:

• Accessed the "/search/delete/id/.../" URI for a global builtin query as a non-administrator.
• Before patch: could improperly disable queries. -After patch: proper policy exception.

Differential Revision: https://secure.phabricator.com/D21851