privileged actions + `privileged? true`

when using `:action/privileged-set-line-items` in a transition, `flex-cli` (or the build api) should check `:privileged? true` and throw an error if it isn't.

not sure if this should also apply to `:action/privileged-update-metadata`