OIDC: Disallow changing admin permissions for oidc users when OIDC group mapping is configured

When a local user is linked with a oidc identity. Or an oidc identity changes the password. They can still use local login. We currently don't really define a account type, so if the password is set, the user can use local auth. If the oidc_id is set, the user can login via oidc.

With the addition of #1033 the admin permissions are synced on oidc login and we maybe want to restrict changing the admin permissions for oidc users.

We also maybe want to disable local login when the user is linked to an oidc identity.

Start by reviewing the OIDC login flow and the admin-permission synchronization introduced by #1033. Clarify whether the intended change is to block local permission edits, disable local login for linked users, or both. Done should include an agreed behavior and tests covering linked OIDC identities, password changes, local authentication, and permission updates.

Written by the indexing model from the issue text.