Allow toggling of user access

[incident-io]

We have ways of effectively restricting user access on a short term basis (e.g. delete user but not ACL, delete/change ACL, rate limit), but it would be very handy in cases with misbehaving clients to be able to quickly enable/disable specfic users (and/or roles) to allow identification and mitigation

This ticket was created from INC-1516 using incident.io 🔥

JIRA Link: CORE-6857