Context: https://github.com/coder/coder/pull/15195#discussion_r1814644800 We should add a separate RBAC role specifically for enqueuing notifications instead of using `dbauthz.AsSystemRestricted`