Summary

Method putUserProfile missing a server-side AuthZ check

Current Behavior

A Member user can make a following PUT request to change their username

curl -X PUT http://coder-server:8080/api/v2/users/{user}/profile \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'Coder-Session-Token: API_KEY' \
  --data-raw '{"username":"jdoe","name":"John Doe"}'

https://coder.com/docs/reference/api/users#update-user-profile

This should not be the case as per:
#3286
#3649

Proposed Changes

We should explicitly check if given user has the update_personal permission (ActionUpdatePersonal) granted in their RBAC policy

	if !api.Authorize(r, policy.ActionUpdatePersonal, user) {
		httpapi.ResourceNotFound(rw)
		return
	}

Also this is most likely a bug and policy.ActionUpdatePersonal should be removed from the Member role