Add paymentSuspended field to org and endpoint to update

[tw4l]

Backend work for #1876

• Adds Organization.paymentSuspended field (optional boolean)
• Adds API endpoint to update paymentSuspended field

This endpoint (which will be called by Cashew) might also make a nice hook for setting orgs read-only when payment fails or a user cancels their subscription moving forward.

[tw4l]

Closing in favor of having an Organization.readOnly field with an optional readOnlyReason str field that can provide the text for the banner, as a more generic solution for the open source project