Provide first class mechanisms to manage system users

Prebuilds introduced the concept of a system user. Other systems might opt to use a system user in the future. System users are identical to other users in most ways, except that they should:

* never be dormant
* not be deleted by any other mechanism that the system that relies on them
* not consume license seats
* not be listed in any queries that return multiple users, unless the request specifies that they should be included.

Systems that require system users should own the responsibility of creating and managing them. If a system user is deleted or tampered with, the system in question is responsible for returning it to a valid state before using it. This is to avoid heavy-handed and imprecise system user management.