Enact non-commercial org restrictions

[ChrisPenner]

Overview

After this PR:

• Projects created in non-commercial orgs default to public
• All other projects still default to private
• Non-commercial org projects cannot be set to private

Implementation notes

• Throw a 403 if trying to update a non-commercial project to private
• Choose project visibility based on org-type if creating in an org.

Test coverage

Transcripts

Loose ends

• Should probably add a note in UCM to indicate the visibility a project was created at.
• @hojberg should indicate to end users when/why they can't set certain projects to Private