Authenticated privilege escalation via self-service admin flag

Incorrect authorization in Konga 0.14.9 allows remote authenticated users to gain administrator privileges through a crafted API request. The PUT /api/user/{id} endpoint accepts an admin value of true for the caller's own account without verifying existing administrative authority. Any authenticated standard account can therefore promote itself to Konga administrator and gain the application's management privileges.