[18MS] Fixes M&M ability to only work for owning corp

[philcampeau]

Fixes #10025

Before clicking "Create"

• Branch is derived from the latest master
• Add the pins or archive_alpha_games label if this change will break existing games
• Code passes linter with docker compose exec rack rubocop -a
• Tests pass cleanly with docker compose exec rack rake

Implementation Notes

Explanation of Change

The M&M private was usable by any corporation that the president of the owning corporation was running. This was corrected by adding when: 'token' to the company in entities.rb, limiting its use to the owning corporation's token laying step.

Screenshots

Any Assumptions / Hacks