Enforce explicit actor-target checks for profile/password updates

[giuscris]

This pull request updates user permission logic in the User class to improve security and ensure users can only perform sensitive actions on their own accounts or, for admins, on other users. The changes focus on refining checks for deleting users, changing options, passwords, and roles.

Permission logic updates:

• Changed canDeleteUser and canChangeRoleOf to allow admins to act only on other users, not themselves.
• Updated canChangeOptionsOf and canChangePasswordOf to allow users to modify only their own options or password, unless they are admins (who can modify any user’s options).

[Copilot]

Pull request overview

This PR tightens permission checks in Formwork\Users\User by switching from session-derived “logged in” checks to explicit actor-vs-target comparisons, ensuring sensitive actions are only allowed for the correct user (or admins, where applicable).

Changes:

• Updated delete/role-change permissions to allow admins to act only on other users (not themselves).
• Updated options/password permissions to allow only self-service changes (with admins allowed to edit any user’s options).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.