Rework auth api

[FedericoNegri]

• Respect as_objects flag in AuthApi.get_users and other methods.
• Allow passing query parameters to get_users, to support filtering/search/pagination.
• Add AuthApi.keycloak_admin_client to expose the KeycloakAdmin client (from the python-keycloak package) we're using. This gives users access to a much larger portion of the keycloak api.
• Remove groups, realm_roles and is_admin fields from the user schema, because they required (costly) separate API calls for the sole purpose of determining whether a user is a REP sys-admin user. For that, one can now use the AuthApi.user_is_admin method. Also, to determine whether a user is admin we now query admin keys from the JMS Api, rather than using hardcoded values.
• Support and test token-exchange for impersonation

[ojkoenig]

Approved, made some detail/tiny comments in the code