Merge "Expand DISALLOW_GRANT_ADMIN restriction" into main