Grant hefee ability to disable puppet

Originally created by @groente on #16065 (Redmine)

Translate is currently administered as a production server, but from an application admin point of view is still under development and requires testing on the machine itself. It would therefore be useful to grant weblate admins the ability to temporarily disable puppet to run tests without puppet overwriting their changes.

Note that this requires a strict policy from the weblate admins to both:

- notify tails-sysadmins@boum.org when they disable puppet (also because we can then acknowledge the monitor alerts that will pop up)

- enable puppet again once they are done with their experiments (and again, notify tails-sysadmins@boum.org)

Feature Branch: feature/16065-sudo-puppet-for-weblate-admins

Parent Task: #11759 (closed)