Port EE-only path restrictions to CE

Doing the CE->EE merge, I came across https://gitlab.com/gitlab-org/gitlab-ee/commit/7cb36159c40be9efc8e43d9fabf0b3e946282aed

I believe these restrictions should be in CE as well as EE, because if they aren't, migrating from CE to EE becomes problematic. This is a supported scenario: https://docs.gitlab.com/ee/update/README.html#community-to-enterprise-edition

Thoughts @reprazent ?