Support disabling users

[skeet70]

IC-ID supports a disabled field on user update and in the database. We bill on users (and groups). Via ironoxide you should be able to disable yourself at least.

As a full feature, we need to make changes to IC-ID for disabling (if not self) to require a JWT so it's server-authoritative instead of making it possible for every user to disable anyone.

Our workaround until this is in is manually disabling users.

[coltfred]

I think we want both disable self and the JWT version of disabling anyone. There is an issue in IC-ID for adding support for the latter, but the former could be added anytime.

[coltfred]

We probably want to add user_update to ironoxide for the user to disable themselves and something similar to user_create (in that it's static and takes a JWT) for the JWT user_update.