Restrict access to instance-level security features for reporters

See merge request gitlab-org/security/gitlab!1536