Update usename with RateLimiter even for admin user

Description:

If you update a username of a user logged in as a admin user, then it is still delimited to 1 per 60 second.

Steps to reproduce:

Make multiple REST calls to user.update with a username set.

Expected behavior:

It should not be delimited for admin user

Actual behavior:

It is delimited

Server Setup Information:

0.66.3

Additional context

The problem is here:

https://github.com/RocketChat/Rocket.Chat/blob/34e607c4326ccb8896c3eb9519fc5c92895a1a2e/packages/rocketchat-lib/server/functions/setUsername.js

RocketChat.setUsername = RocketChat.RateLimiter.limitFunction(RocketChat._setUsername, 1, 1000, {
	[0](userId) {
		return !userId || !RocketChat.authz.hasPermission(userId, 'edit-other-user-info');
	}
});

!RocketChat.authz.hasPermission(userId, 'edit-other-user-info') checks if the user which is being changed has this permission, but not if the user who performs the change has it.

That means that admin can change usernames without delimiter of admins only.

Relevant logs:

You must wait 60 seconds before trying again. [error-too-many-requests] at EventEmitter.setUsername (/app/bundle/programs/server/packages/rocketchat_lib.js:2902:15) at EventEmitter.RocketChat.saveUser (/app/bundle/programs/server/packages/rocketchat_lib.js:5354:18) at DDPCommon.MethodInvocation.Meteor.runAsUser (/app/bundle/programs/server/packages/rocketchat_api.js:5721:52) at packages/dispatch_run-as-user.js:211:14 at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1186:12) at Object.Meteor.runAsUser (packages/dispatch_run-as-user.js:210:33) at Object.post (/app/bundle/programs/server/packages/rocketchat_api.js:5721:12) at Object._internalRouteActionHandler [as action] (/app/bundle/programs/server/packages/rocketchat_api.js:197:37) at Route.share.Route.Route._callEndpoint (/app/bundle/programs/server/packages/nimble_restivus.js:347:32) at /app/bundle/programs/server/packages/nimble_restivus.js:236:33 at packages/simple_json-routes.js:98:9

Start with packages/rocketchat-lib/server/functions/setUsername.js and reproduce the issue with multiple REST user.update calls using an admin user. Trace which user is passed to the edit-other-user-info permission check in RocketChat.setUsername. Done means admin-initiated username updates are not rate-limited, while updates by users without the permission remain limited.