[FEATURE] Require 'system_administrator' permission to '/plugins/caas_next_refid' endpoint

[lorawoodford]

Is your feature request related to a problem? Please describe.
Extend required 'system_administrator' permission to existing '/plugins/caas_next_refid' endpoint per the following request: #17 (comment)

Describe the solution you'd like
Add permission.

Describe alternatives you've considered
N/A

Additional context
Request stemming from permissions structure on new endpoints added via #17

[lorawoodford]

Dragging this issue to "On Hold" given the difficulty encountered while working on it. Essentially, while adding in permissions to the backend controller works fine for those accessing this endpoint via the API, it does not work when the API call is triggered from the frontend form (aka, when a new ao is created or when an existing ao has the "regenerate ref id" checkbox checked) because the autogenerate action in the archival object model calls the API endpoint without session information on the frontend user that is making the request. This is likely solvable, but would require more work than there is time for given our desire to get the plugin into production.