Expiring users/offboarding users (ent)

Two main use-cases
- Automatically expire users after a configurable relative duration in which a user has logged in
- Offboarding, per-user absolute datetime where account is deactivated.
- Potentially also password expiry (side-task)

Common:
- Both actions need revoke all tokens/sessions/etc

Differences:
- Offboarding date is saved per-user
- Auto-expiry is saved per group...?

### Ideas for implementation:

#### Use Object Lifecycle system
- add option to select user
- Add type to lifecycle rules of {review, action}
- add action of expire
- figure out how to deal with offboarding of a single user

#### User state
Maybe we need to get rid of `is_active` and replace it with a `state`/`status` field of {active, deactivated, locked}? This would allow us to show better UI in flows for locked accounts (mainly applies to auto-expiry), to tell users they might need to reset passwords/etc.

Migration path:
- Add `status` + `deactivation_reason` (release 1), which writes to both
- Remove `is_active` (backfill from logic above) (release 2)

Very rough idea: does any of the lockdown stuff help here? Might be helpful when locking a user.

cc @atereshkin for opinions/thoughts