Prevent users without RUN_SCRIPTS permission from editing Groovy DSL

Groovy DSL isn't sandboxed (see [JENKINS-16980](https://issues.jenkins-ci.org/browse/JENKINS-16980)), and some work needs to be done to determine what should be exposed to the script via e.g. JobInvocation.

So as a temporary solution, require RUN_SCRIPTS to edit the DSL instead of simply Job/CONFIGURE. Shouldn't be an issue in unsecured (or mostly unsecured) Jenkins, and will fix a security hole in secured Jenkins.