<!-- The PR description should answer 2 important questions: -->

### What

<!-- What is this PR trying to accomplish (and why, if it's not
obvious)? -->

<!-- Consider: do we need to add a changelog entry? -->

<!-- Does this PR introduce new validation that might break old builds?
-->

<!-- Consider: do we need to put new checks behind a flag? -->

Until now the `allow_subscriptions` in select permission is no-op. This
PR implements its intended functionality, i.e, do not generate
subscription root field schema for models that don't have
`allow_subscriptions: true`.

### How

<!-- How is it trying to accomplish it (what are the implementation
steps)? -->
- Plumb the `allow_subscriptions` value to namespace annotation.
- Modify subscription root field annotations; filter roles by
allow_subscriptions.
- Add a check in IR generation for the permission and raise an internal
error, if the check fails.

V3_GIT_ORIGIN_REV_ID: 98120809b1294716c96c190e1b6ec875635b5da1