Add option to require delete permission for disabling Keep Forever

With this option checked, users with Run.UPDATE will be able to mark
builds as Keep Forever, but will not be able to remove that status
to prevent these users from effectively deleting builds due to log
rotation.

Basically JENKINS-16417, just not as ambitious.