Update session timeout for a company

Array of sso connections

Consent settings governing who may reach a Link (mablnet) tunnel owned by this workspace or company. Deliberately separate from support_access_config: not all of this has anything to do with support, and reaching a customer's network is a distinct decision from seeing their workspace.

This is the set an owner of either kind carries. A workspace additionally carries enable_personal_tunnels — see WorkspaceLinkAccessConfig, which extends this. That flag is meaningless for a company: a personal tunnel belongs to a user, and both halves of the decision it governs are asked of a workspace.

Everything here is opt-in. An absent config, and an absent setting within a present config, both admit nobody; only new trial workspaces are created with anything enabled. None of this affects api-key access to a tunnel — an execution key reaching a tunnel for a cloud test run is unaffected throughout.