fix: prevent privilege escalation by non-superusers in the user admin

[tdruez]

Issues

• Closes: BUG: User in legal group and with staff status is effectively a superuser #266

Changes

• Restrict viewing, changing, and disabling users in the admin to superusers
• Allow non-superusers with the add permission to create users
• Make the superuser status read-only on user creation by a non-superuser
• Limit the assignable groups on user creation to the non-superuser's own groups
• Add tests covering user management restrictions and user creation by a non-superuser