feat!: drop reading other 'user' permission (#8650)

* feat: drop reading other 'user' permission

Members of the platform can no longer read or list other users.
Resources that have "created_by" or "initiated_by" still retain
user context, but only include username and avatar url.

Attempting to read a user found via those means will result in
a 404.

* Hide /users page for regular users
* make groups a privledged endpoint
* Permissions page for template perms
* Admin for a given template enables an endpoint for listing users/groups.

enterprise/coderd/templates_test.go

@@ -885,6 +885,17 @@ func TestUpdateTemplateACL(t *testing.T) {
 		err := client.UpdateTemplateACL(ctx, template.ID, req)
 		require.NoError(t, err)
 
+		// Should be able to see user 3
+		available, err := client2.TemplateACLAvailable(ctx, template.ID)
+		require.NoError(t, err)
+		userFound := false
+		for _, avail := range available.Users {
+			if avail.ID == user3.ID {
+				userFound = true
+			}
+		}
+		require.True(t, userFound, "user not found in acl available")
+
 		req = codersdk.UpdateTemplateACL{
 			UserPerms: map[string]codersdk.TemplateRole{
 				user3.ID.String(): codersdk.TemplateRoleUse,
@@ -897,10 +908,13 @@ func TestUpdateTemplateACL(t *testing.T) {
 		acl, err := client2.TemplateACL(ctx, template.ID)
 		require.NoError(t, err)
 
-		require.Contains(t, acl.Users, codersdk.TemplateUser{
-			User: user3,
-			Role: codersdk.TemplateRoleUse,
-		})
+		found := false
+		for _, u := range acl.Users {
+			if u.ID == user3.ID {
+				found = true
+			}
+		}
+		require.True(t, found, "user not found in acl")
 	})
 
 	t.Run("allUsersGroup", func(t *testing.T) {