Make default ACO for new Queries configurable

[Krock21]

Currently, "New Query" prepopulates ACO selector to nobody. We need to make it configurable somewhere

For now, we can add a new UI setting "default access control for new queries"

Later we may add similar thing to server side and allow cluster admins to configure default ACO that should be applied if user did not override it in UI settings

cc @achulkov2