Comment 3 for bug 1682411

I've added 2.3 as a target as there will be separate solutions for 2.2 and 2.3 series. Short term solution will limit permission on a socket. Long term solution will carefully consider use cases and potentially replace global juju-run with dedicated and permission-limited commands like set-status, set-config, etc.