We've had conflict review documents for many years now to handle the IESG balloting on conflict reviews of documents in other streams.

However, the older ability to open a ballot on any document still exists, and is a trap for new ADs.

Change the permissions such that new ADs can't make the mistake of balloting directly on other stream's documents.