Check update_organization_user when updating organization users

What does this MR do and why?

Users::UpdateService#can_update_organization_users? guarded organization user updates with the update_organization permission, which covers editing the organization's own settings. The permission that describes changing an organization's members is update_organization_user, defined in config/authz/permissions/organization_user/update.yml and granted to the same admin and organization_owner roles.

This MR switches the check to update_organization_user. Both roles currently hold both permissions, so there is no behaviour change today; the fix aligns the check with the action before the two permissions diverge (for example through assignable permissions). A spec stubs the permission to prove it is the one being consulted.

References

• Resolves #628443 (closed)

Differences

Before: A caller who holds update_organization but not update_organization_user can change organization user access levels through Users::UpdateService.

After: The service requires update_organization_user on each organization named in organization_users_attributes, and returns "Insufficient permission to modify user organizations" otherwise.

How to set up and validate locally

1. Confirm the permission exists: config/authz/roles/organization_owner.yml lists update_organization_user under organization.raw_permissions.

2. Run the service spec:

   bundle exec rspec spec/services/users/update_service_spec.rb -e "organization user"

3. The new context "when the owner lacks the update_organization_user permission" fails on master and passes with this MR.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.