Add RBAC to the /pulp/api/v3/users/ APIs

Problem Statement

Currently the Users API does not have an AccessPolicy and therefore no RBAC. This means that mutli-user Pulp systems today are a free-for-all in terms of creating/deleting or updating user data, e.g. passwords.

Proposed Solution

Similar to other RBAC endpoints, an AccessPolicy can be added to the User endpoints. Specifically:

/pulp/api/v3/users/
/pulp/api/v3/users/:UUID/

This would be similar to other AccessPolicies in that:

• There are CRUD permissions at the object and model level
• Users who can create users get to manage that user over time.

Alternatives

We could use superuser as the only persona that can manage users. I think that is a non-starter for multi-tenant Pulp systems since any superuser can modify/delete any other user or superuser in the system

Open Questions

Shouldn't users be able to edit their own attributes, e.g. their password or username?

Start by reviewing the existing AccessPolicies for comparable RBAC endpoints, then inspect the /pulp/api/v3/users/ and /pulp/api/v3/users/:UUID/ entry points. Define and verify model- and object-level CRUD permissions, including ongoing management by the user creator, and resolve the open question about users editing their own attributes.