Fix applicative privilege escalation.

[corentin-soriano]

Now, a manager can edit existing user and give him admin role.

• Cast $session_user_manager to int -> to fix issue where managers can't see "users" section (but can access with ?page=users)
• Better check for remaining admins when demoting a user.
• Improve permissions check.

We can edit like this:

• Administrators can edit any user.
• Managers can edit only basic users and read only users which are administered by their group and can't promote more than basic user.
• Teampass managers can edit all basic and read only users whatever their group and can't promote more than basic user.
• Other users can't edit any users.
• Managers/teampass managers can't edit other managers.

I changed new_user to fit as this to and moved this error before "duplicate login" because it is a good practice.
We redid a series of tests to validate that it is no longer possible to create/modify a user in an illegitimate way.