[MM-28533] [MM-28532] [MM-28531] Fixes several bugs with sysconsole_write_usermanagement (#15559)

* MM-28533 Fix incorrect permission check for reset password

* Allow write users to edit other users, promote and demote guests

* Update ancillary perms for PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_USER

* MM-28532

* Dont allow non sysadmin to update passwords / reset passwords / patch user on sysadmins

* MM-28532: Updates test.

* MM-28533: Merge fix.

* MM-28533: Adds ability for new roles to activate/deactivate non-system-admin users.

Co-authored-by: Martin Kraft <martin@upspin.org>
Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

model/role.go

@@ -45,6 +45,7 @@ func init() {
 		CHANNEL_ADMIN_ROLE_ID,
 	}, NewSystemRoleIDs...)
 
+	// When updating the values here, the values in mattermost-redux must also be updated.
 	SysconsoleAncillaryPermissions = map[string][]*Permission{
 		PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_CHANNELS.Id: {
 			PERMISSION_READ_PUBLIC_CHANNEL,
@@ -69,10 +70,17 @@ func init() {
 		PERMISSION_SYSCONSOLE_READ_REPORTING.Id: {
 			PERMISSION_VIEW_TEAM,
 		},
+		PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_USERS.Id: {
+			PERMISSION_EDIT_OTHER_USERS,
+			PERMISSION_DEMOTE_TO_GUEST,
+			PERMISSION_PROMOTE_GUEST,
+		},
 		PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_CHANNELS.Id: {
 			PERMISSION_MANAGE_TEAM,
 			PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES,
 			PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES,
+			PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS,
+			PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS,
 			PERMISSION_DELETE_PRIVATE_CHANNEL,
 			PERMISSION_DELETE_PUBLIC_CHANNEL,
 			PERMISSION_MANAGE_CHANNEL_ROLES,
@@ -80,6 +88,7 @@ func init() {
 			PERMISSION_CONVERT_PRIVATE_CHANNEL_TO_PUBLIC,
 		},
 		PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_TEAMS.Id: {
+			PERMISSION_MANAGE_TEAM,
 			PERMISSION_MANAGE_TEAM_ROLES,
 			PERMISSION_REMOVE_USER_FROM_TEAM,
 			PERMISSION_JOIN_PRIVATE_TEAMS,