Ensure only team admins can list other users

[GuillaumeRoss]

Goal

TODO
In the April 2022 pentest of Fleet, it was discovered that it is possible to enumerate users with api/v1/fleet/users/<USERNUMBER>. Due to error messages that differ between valid and invalid emails and the lack of throttling, an authenticated users could enumerate valid email addresses.

This is a minor privacy issue, and we should address it by:

1. Making enumeration possible only for team admins (so not for team observers or team maintainers). Admins should be able to enumerate so they can add users to their own teams.
2. Potentially adding throttling.

When ready to start working on this, let's discuss the exact implementation details.

[mikermcneil]

@xpkoala @lukeheath This is a bug, if it's still in the product, since this would mean Fleet isn't working as documented.

[lukeheath]

@xpkoala Please reproduce, and if it's still present, assign it to Sharon. Thanks!

[xpkoala]

Confirm only admin access can hit this api, not rate limiting the endpoint is fine in this case. It that is the case we can close this out.

[lukeheath]

Thanks for checking, closing as expected behavior.

[fleet-release]

Admins guard the list,
Secure users' privacy,
Swift clouds protect all.