Clean up UserRules

[distantnative]

Description

• Merge Fix $user->roles($purpose) #6653 first

Summary of changes

• Added guards for non-admin changing admins as well as changing last admin to UserPermissions::canChangeRole() instead of UserRules::changeRole()
• Deprecated UserRules::validRole() as checks need to be more specific with a specific roles collection that this helper method cannot provide
• Added instead a role validation check to UserRules::changeRole()
• Removed permissions check from UserRules::create() that Is already covered by the general permissions check running UserPermissions::canCreate()

Changelog

Deprecated

• UserRules::validRole()

Ready?

• In-code documentation (wherever needed)
• Unit tests for fixed bug/feature
• Tests and CI checks all pass