feat!: drop reading other 'user' permission (#8650)

* feat: drop reading other 'user' permission

Members of the platform can no longer read or list other users.
Resources that have "created_by" or "initiated_by" still retain
user context, but only include username and avatar url.

Attempting to read a user found via those means will result in
a 404.

* Hide /users page for regular users
* make groups a privledged endpoint
* Permissions page for template perms
* Admin for a given template enables an endpoint for listing users/groups.

site/src/utils/groups.ts

@@ -15,6 +15,10 @@ export const getGroupSubtitle = (group: Group): string => {
     return `All users`
   }
 
+  if (!group.members) {
+    return `0 members`
+  }
+
   if (group.members.length === 1) {
     return `1 member`
   }