Disallow editing of user properties that come from Cognito

[benmartin-coforma]

Description

This PR locks down the username field of the EditUser page (which is visible only to admins). Previously, this page could be used to change the username, but there shouldn't be a need to do so - username will come from Cognito.

There is a possibility that this functionality will be needed in the future; requirements analysis is ongoing, and we may someday add this ability back.

This PR also adds stricter validation for the fields that can be updated from the EditUser page.

Related ticket(s)

CMDCT-4234

---

How to test

1. Log in as an admin user
2. Go to View / Edit Users
3. Click a username to go to the Edit page
4. Note that the username field is disabled - as are all string fields
5. Attempt to edit role or state. Note that the update succeeds.

Notes

---

Pre-review checklist

• I have added thorough tests, if necessary
• [ ] I have updated relevant documentation, if necessary
• I have performed a self-review of my code
• I have manually tested this PR in the deployed cloud environment

---

Pre-merge checklist

Review

• Design: This work has been reviewed and approved by design, if necessary
• Product: This work has been reviewed and approved by product owner, if necessary

Security

If either of the following are true, notify the team's ISSO (Information System Security Officer).

• These changes are significant enough to require an update to the SIA.
• These changes are significant enough to require a penetration test.

[codeclimate]

Code Climate has analyzed commit 29e5ea8 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (90% is the threshold).

This pull request will bring the total coverage in the repository to 82.5% (0.2% change).

View more on Code Climate.