feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

services/convert/user.go

@@ -9,8 +9,32 @@ import (
 	"gitea.dev/models/perm"
 	user_model "gitea.dev/models/user"
 	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 )
 
+func userTypeToString(t user_model.UserType) api.UserTypeString {
+	switch t {
+	case user_model.UserTypeOrganization, user_model.UserTypeOrganizationReserved:
+		return api.UserTypeStringOrganization
+	case user_model.UserTypeBot:
+		return api.UserTypeStringBot
+	default:
+		return api.UserTypeStringUser
+	}
+}
+
+// UserTypeFromString parses a user type an admin may create or convert to
+func UserTypeFromString(s api.UserTypeString) (user_model.UserType, error) {
+	switch s {
+	case api.UserTypeStringUser:
+		return user_model.UserTypeIndividual, nil
+	case api.UserTypeStringBot:
+		return user_model.UserTypeBot, nil
+	default:
+		return 0, util.NewInvalidArgumentErrorf("invalid user type %q (expected %s, %s)", s, api.UserTypeStringUser, api.UserTypeStringBot)
+	}
+}
+
 // ToUser convert user_model.User to api.User
 // if doer is set, private information is added if the doer has the permission to see it
 func ToUser(ctx context.Context, user, doer *user_model.User) *api.User {
@@ -50,6 +74,7 @@ func toUser(ctx context.Context, user *user_model.User, signed, authed bool) *ap
 	result := &api.User{
 		ID:          user.ID,
 		UserName:    user.Name,
+		Type:        userTypeToString(user.Type),
 		FullName:    user.FullName,
 		Email:       user.GetPlaceholderEmail(),
 		AvatarURL:   user.AvatarLink(ctx),