CRASM- 2829: Ensure users can't update themselves except name

[aloftus23]

🗣 Description

This ticket addresses the issue with users being able to update their own user objects.

• Ensures the PUT /v2/users/{} endpoint has correct role based permissions and users can only update specific fields like first_name and last_name
• Write more pytests to ensure this stays locked down

💭 Motivation and context

Users should only be able to update their first_name and last_name.

🧪 Testing

Created new pytests and passes pre-commit and github checks.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• Tests have been added and/or modified to cover the changes in this PR.
• All new and existing tests pass.
• Bump major, minor, patch, pre-release, and/or build versions as appropriate via the bump_version script if this repository is versioned and the changes in this PR warrant a version bump.
• Create a pre-release (necessary if and only if the pre-release version was bumped).

✅ Pre-merge checklist

• Revert dependencies to default branches.
• Finalize version.

✅ Post-merge checklist

• Create a release (necessary if and only if the version was bumped).