User account needs flag to prevent login/activity (user ban)

Is your feature request related to a problem? Please describe.
As a Janeway administrator, I need a convenient method to prevent a user from logging in or making new submissions to a Janeway journal or repository.

Describe the solution you'd like
Add new toggle option to user profile, visible in Django admin and user table: Is banned

When ticked true:

• User cannot log in
• User cannot make new submissions

When user tries to log in, they should receive a relevant message, e.g. Unable to log in. Please contact administrator.

Mockup

dev notes
We also want to rename "Is Active" to "Email Validated", which is what that field is being used for.
Since we want to record the reason for a ban, consider not using a bool flag, but rather a m2m to a new model that stores:

• Reason: TextField
• enforced: Boolfield.
• actor: ForeignKey to account who created the ban (optional)
• date_created: DateField with autocreate=True
• site: A GenericForeign key to a child of AbstractSiteModel (ban at journal/preprint/press level)

Other considerations:

• Consider using a different name other than "ban" (e.g suspended)
• When a user is banned, active sessions will need to be deleted.
• Users shouldn't be able to self-ban
• Superusers/admins cannot not be banned.
• Add a setting that controls if editors have access to user ban powers (default to journal managers)
• Add a setting to allow repository managers to ban users from repository sites
• Pages that list accounts will need to consider if the banned users should be displayed.
• Pages that allow adding users directly (i.e. by email address) need to prompt a meaningful error.

We can then implement an is_banned() method like:

def is_banned(self, site):
   return any(self.banreason_set.filter(enforced=True, site=site))

Review the existing user profile, Django admin, login, and submission flows before choosing a ban or suspension model. Trace how site scope, permissions, sessions, account lists, and email-based user additions currently work. Done means the agreed design prevents login and new submissions, reports a useful message, handles active sessions and privileged users, and covers the listed site and permission settings.