Ability to lock down Access Agents

Due to recent issues it has come to attention there is not a way to lock down who can download the Access Agent installers from an OnPrem instance. There should be a way that either the download files can be renamed from the system settings or require a ControlAdmin to approve any new instance before it start communicating to the instance. 

Renaming Files: This should be a setting that we can add a prefix to the default installer file so the system fully recognizes this for updates from version to version as well. Or ability to change the default directory these files reside in for the system would also be a valid option for this as well. 

ControlAdmin Approval: This would look like after an endpoint installs the agent a notification is sent to the ControlAdmin or other selected role to approve this for check in as a Access Agent.