Limit how a user becomes an admin

[humphd]

We have the concept of an admin role in the User and Auth services, in the front-end, etc. In Firebase it's a boolean, isAdmin: true|false. We need to tighten how a user becomes an admin.

You shouldn't be able to POST that data to the Users service (we should ignore it). The current system is too loose.

[humphd]

POST /:id   - a user who owns id, or admin, or service (exclude isAdmin)
PUT /:id   - a user who owns id, or admin, or service (exclude isAdmin)
PUT /:id/admin - only an admin can do this?

[humphd]

Based on the changes I just made in #2344, we can probably do this by insisting that only an admin (super user via env, or existing admin) can update an existing user to an Admin in the db. The work in #2153 is heading in this direction, we just need to finish it.

[humphd]

@chrispinkney and @manekenpix started this work in #2239, and we can likely build on the initial PR there to get this done, once the users backend is in place.

[humphd]

In #3030 I'm suggesting that we use GitHub OAuth with org/team membership to define our admins. Closing this in favour of that.