Add "Disable user" functionality to the Auth dashboard

[chipilov]

Currently, you can easily remove existing users from the Dashboard by going to the users' table under Auth and clicking on "Delete user".

It would be nice if you also had a button called "Disable user" similar to Firebase. The expectation for a disabled user is that:

• the user will no longer be allowed to login;
• Ideally, disabled users will NOT be able to authenticate even if they have a valid access token. I understand that this would require to keep a list of revoked access tokens but if this happens rarely (as expected) and the check is done ONLY if the list of revoked tokens is NOT empty, this should NOT have any effect on perf most of the time;
• Even if the access token cannot be revoked as described above, it would still be helpful that the disabled user will no longer be able to login after their access token expires;
• RLS rules can use the disabled field to forbid access to any user that is marked as disabled so even if the user still has a valid access token, they will NOT be able to do anything;

Currently, all this can be achieved but as far as I can tell it requires the following manual work:

• manually remove or revoke all refresh tokens for the user from the auth.refresh_tokens table - this will prevent the user from refreshing their access token automatically;
• manually modify the password of the user in the auth.users table - this will prevent the user from logging in again after their current access token expires; IMPORTANT: One must ensure that the user is NOT able to re-set their password while their current access token is still valid;

[MildTomato]

related
https://github.com/orgs/supabase/discussions/9239#discussioncomment-3766124

we could put this logic behind a button in dashboard

[ADSNB]

We definitiely need this feature!

Currently I`m using ban duration but still you have to put an expiration time...

It will be nice if we have an toogle option like IsActive.