Use a single configuration permission and mark it restricted access

There's no need to separate configuring the module from managing form strategies. Let's just use a single permission for them and ensure it is marked as restricted access. (Adding the restricted access notification will need to be done in the D7 branch, too.)