Implements admin API to lock an user (MSC3939)

[MatMaul]

This PR implements a way to lock an user without deactivating them.

It is based on MSC3939.

The locked user is also hidden from the user directory. This behavior can be tweaked with an option.

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file.
• Pull request includes a sign off
• Code style is correct
  (run the linters)

[MatMaul]

This comment suggests that this MSC was also written to deal with the expiring accounts feature.

I am hence inclined to:

• ditch allow_expired parameter from get_user_by_req and use allow_locked for both
• return the locked error code in the expired account case

I think it also mean that we want to deprecate is_user_expired module API and introduce is_user_locked instead.

I'll not do that in this PR and push a new one later on.

[MatMaul]

@sandhose @hughns do you have an insight about if we should do that in the MSC3861 case too ?

I feel that it is perhaps something that should be dealt with by the OIDC provider, but I also think that it doesn't hurt to have the synapse layer provides an extra mechanism on top.

[MatMaul]

Even if we keep the synapse layer here, if a mechanism exists to signal a locked user in OIDC (does it ?), we should probably convert that to the proper synapse API error code (introduced by MSC3939).

[sandhose]

I recently implemented account locking in MAS. This should be implemented when Synapse introspects the token ; there is no standard on the introspection API to signal that, but we can do something somewhat custom. It's already on my radar

[erikjohnston]

Woo!