Plugins: Hide plugins page from viewers, and limit /api/plugins to only core plugins when called by viewer role  (#21901)

* Hide plugins list from viewers

* Made /api/plugins only return core plugins for users with viewer role

Co-authored-by: Torkel Ödegaard <torkel@grafana.com>