Remove all ensure_root and replace with EnsureOrigin<>

[1xstj]

Issue summary We use ensure_root in a lot of places, the better way to handle this check is to have a ForceOrigin and then configure it from runtime. This will make our future migrations a lot easier when we move away from Sudo.

[herou]

@dutterbutter please, assign it to me.