Prevent modification of /_users/_security object with opt-out ini file setting

## Expected Behavior
Modifying the `_security` object inside of `_users` is unsupported, and can lead to some unusual behaviour - see #1556.

## Current Behavior
We allow people to shoot themselves in the foot by modifying `_users/_security`.

## Possible Solution
Always return a `403` on write attempts for `_users/_security`. @rnewson do you have any comment on this?

## Steps to Reproduce (for bugs)
1. `dev/run -n 1 --with-admin-party-please`
2. `curl -X PUT http://localhost:15984/_users/_security -d '{"foo": "bar"}'

## Context
People are trying to change the rules for who can read/write documents in `_users` and it goes very badly.

## Your Environment
* Version used: 2.2.0

Start by reproducing the PUT request against /_users/_security with dev/run -n 1 --with-admin-party-please, then trace the request handling and configuration path for the proposed opt-out ini setting. Done means the setting's behavior is defined and write attempts to _users/_security produce the intended response without breaking normal _users access.

Written by the indexing model from the issue text.