thunderbolt: only try to enroll if we are allowed

Check via Polkit if the current user is actually allowed to enroll devices before trying to do so. If not, show a notification that explains that a system administrator needs to authorize the device. Clicking on the notification will guide the user to the thunderbolt control center panel. Before this patch, when the current user was not allowed to enroll a device a polkit dialog would pop up which is confusing because it did not contain any information why it was shown. This patch implements the behavior as designed (see Multi-user environments).

Closes #709 (closed)