Support a hardcoded user list

For GSoC, I would like to run corobo on our Zulip with a hard-coded user list.

This allows immediate re-activation of all features, as any misuse would have drastic consequences on the abuser.

Then other people can remain on the Zulip instance, and more can join the Zulip, without security problems.

The issue names no files, tests, or entry points, so begin by mapping corobo’s Zulip user-selection and feature-activation paths. Clarify the hard-coded list’s configuration and security behavior with maintainers, then define tests proving listed users are re-activated without exposing features to others.

Written by the indexing model from the issue text.